User input directly concatenated to LLM prompt
User-controlled input is concatenated into the system prompt without sanitization, allowing prompt injection attacks.
CWE
CWE-77
CVE
N/A
OWASP
N/A
CVSS Score
9.0
Source
AISecurity
Category
Prompt Injection
Exploitability
Exploitable
Detected
2026-05-31 19:02
Code Location
src/ml_pipeline/chat_service.py:56prompt = f"You are an assistant. User says: {user_input}. Respond helpfully."AI Explanation
Prompt injection allows attackers to override system instructions and extract sensitive data or perform unauthorized actions.
Remediation Suggestion
Separate system and user messages using the API's message structure. Never concatenate user input into system prompts.
Change Status