LLM-chosen URL fetched by server: SSRF via prompt injection
Rule ID: vetkit.llm-app.llm-chosen-url-fetch
The server fetches a URL chosen by the language model (model output or an argument of an LLM tool). A prompt-injected request can point it at internal services (cloud metadata endpoints, admin panels, databases behind the firewall) and read the response back through the model (server-side request forgery).
Last updated:
Suite: AI code risks
python
The server fetches a URL chosen by the language model (model output or an argument of an LLM tool). A prompt-injected request can point it at internal services (cloud metadata endpoints, admin panels, databases behind the firewall) and read the response back through the model (server-side request forgery).
Category: LLM SECURITY · Engine rule severity: WARNING
How to fix it
Resolve the URL and allow only https to an allow-list of hosts (or reject private, loopback and link-local addresses after DNS resolution), disable redirects or re-check each hop, and fetch through an egress proxy that cannot reach internal networks. Fixed-host templates where the model only fills a query value are not reported.
References
Source: packages/engine/rules/llm-app/python.yml.
Related checks
- LLM agent code execution tool: Python REPL or shell tool
- Vite define exposes LLM API key in the client bundle
- LLM call without max tokens limit on request input
- LLM output executed as code or shell command
- LLM-chosen file path used to write or delete files
- LLM output rendered as HTML without sanitising: XSS
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.