Skip to content

MIR0804

TaintedLlmPrompt

Tainted input reaches a @taint-sink llm_prompt parameter without sanitization.

<?php
$prompt = $_GET['q'];
$llm->complete($prompt); // TaintedLlmPrompt

Validate or sanitize untrusted input before building an LLM prompt.