Unsanitized Output Rendering

Frontends render model output as raw HTML or markdown with remote resources enabled.

Impact

XSS, CSRF, and zero-click exfiltration through the chat UI.

Why this severity

Impact High × Likelihood Medium = High

Impact high: XSS and exfiltration. Likelihood medium: a stored-XSS cookie theft path was demonstrated in Lenovo's support chatbot.

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.

Method: OWASP Risk Rating Methodology

Evidence

Demonstration: Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot (MITRE ATLAS case study AML.CS0060, 2025)
Demonstration: ChatGPT Conversation Exfiltration (MITRE ATLAS case study AML.CS0021, 2023)

Exploited by

Output-Rendered Data Exfiltration Threat · High severity

Mitigated by

Output Encoding & Strict CSP Guardrail · Fixes high risks

Remediation

Render with a sanitizer that strips scripts, event handlers, and remote images.
Apply a strict Content-Security-Policy on chat surfaces.
Proxy or block external URLs in generated links.

How to verify

XSS payload corpus produces no script execution.
Browser tests confirm img-src blocks non-allowlisted hosts.

Pattern

html = DOMPurify.sanitize(marked(output), { FORBID_TAGS: ['img', 'iframe'] });

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM05:2025 Improper Output Handling

MITRE ATLAS

AML.T0077 LLM Response Rendering

NIST AI RMF 1.0

MEASURE 2.7 AI system security and resilience are evaluated and documented