vetkit.llm-app.llm-output-code-execution
Text generated by a language model is executed as code or as a shell command. Anyone who can influence the model's input (a chat message, a web page or document it reads) can use prompt injection to make it emit code that then runs with the server's privileges. Text generated by a language model is executed as code, as a shell command or as a template. Anyone who can influence the model's input (a chat message, a web page or document it reads) can use prompt injection to make it emit code that then runs with the server's privileges.
Last updated:
Suite: AI code risks
javascript, typescript
Text generated by a language model is executed as code or as a shell command. Anyone who can influence the model's input (a chat message, a web page or document it reads) can use prompt injection to make it emit code that then runs with the server's privileges.
Category: LLM SECURITY · Engine rule severity: ERROR
How to fix it
Do not execute model output. Have the model return structured data validated against a schema and map it to an allow-list of operations; if generated code must run, run it in an isolated sandbox without credentials, network or access to the host.
References
Source: packages/engine/rules/llm-app/javascript.yml.
python
Text generated by a language model is executed as code, as a shell command or as a template. Anyone who can influence the model's input (a chat message, a web page or document it reads) can use prompt injection to make it emit code that then runs with the server's privileges.
Category: LLM SECURITY · Engine rule severity: ERROR
How to fix it
Do not execute model output. Have the model return structured data validated against a schema and map it to an allow-list of operations; if generated code must run, run it in an isolated sandbox without credentials, network or access to the host.
References
Source: packages/engine/rules/llm-app/python.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.