LLM output is not passed to dynamic code execution functions

Passing AI model output directly to eval(), Function(), shell execution utilities, or child process spawners creates a remote code execution (RCE) vulnerability gated entirely on prompt injection success. OWASP LLM02:2025 (Insecure Output Handling) names this as the most severe consequence class; MITRE ATLAS AML.T0051 classifies it as adversarial exploitation of agentic AI systems. CWE-94 (Improper Control of Code Generation) applies directly. A successful prompt injection in an application that executes model output does not just override behavior—it achieves arbitrary code execution on the application server with the process's full privileges. NIST AI RMF MAP 5.1 requires explicitly mapping and controlling the actions an AI system can initiate, with code execution at the top of that list.

AI output must never be treated as executable. Validate it against a strict schema before any processing, and if code execution is an intended feature, route it through a sandboxed environment with no network access and no filesystem write permissions.

// src/lib/ai-actions.ts — safe model output handling
const ActionSchema = z.object({
  action: z.enum(['search_docs', 'get_user', 'create_draft']), // strict allowlist
  targetId: z.string().uuid(),
})

const raw = completion.choices[0]?.message?.content ?? ''
let parsed: unknown
try {
  parsed = JSON.parse(raw)
} catch {
  throw new Error('Model returned non-JSON output')
}

const validated = ActionSchema.safeParse(parsed)
if (!validated.success) {
  // Model output failed schema validation — do not proceed
  throw new Error('Unexpected model output shape')
}

// Execute only validated, allowlisted actions
await executeAction(validated.data.action, validated.data.targetId)

For intentional code sandbox features, use e2b or an isolated container with explicit capability restrictions—never Node.js built-in execution mechanisms with untrusted input.