# LLM output and fields into shell

Model or user strings reaching shell, eval, or generated code without escaping

_Area: AI and LLM app security. Seen in 3 disclosed reports; one confirmed bounty: $3,134; latest 2026-04-16. Updated 2026-10-31._

## How it works
A string the attacker controls reaches an interpreter (shell, Pyodide, eval, generated code) without escaping. The broken assumption is that the string is "just data" or "just a prompt." When an LLM's output is executed as code, the prompt itself becomes the injection surface: user text in the prompt can steer the model to emit code that runs verbatim. When a tool builds a shell string, every interpolated field is a potential breakout, not only the obvious ones.

## Where it shows up
- User input placed into a prompt template slot whose model output is then passed to `pyodide.runPythonAsync`, `eval`, `exec`, or a subprocess [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-f228-chmx-v6j6.md)
- Shell strings assembled with `sshpass`/`ssh` where only some parameters are escaped [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4c65-9gqf-4w8h.md)
- Code-generation features that interpolate user fields (URIs, filenames, IDs) into generated shell or Python [E3](https://bugbountylibrary.com/r/blog%3Ablog-3133700-xyz-bug-vertex-ai.md)
- Agent tools that ingest web pages, files, or credentials and forward them into commands [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4c65-9gqf-4w8h.md)
- Heredocs or string templates where a crafted value can break out of quoting [E3](https://bugbountylibrary.com/r/blog%3Ablog-3133700-xyz-bug-vertex-ai.md)

## How to review
Trace every attacker-reachable string to each interpreter sink. The invariant: no model output or user field reaches a shell, eval, or generated-code sink without escaping or parameterization appropriate to that sink. For shell, enumerate every interpolated parameter (username, host, port, not just password/command) and confirm each is escaped or passed as an argument [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4c65-9gqf-4w8h.md). For code execution from LLM output, confirm the output is validated or sandboxed rather than run verbatim [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-f228-chmx-v6j6.md). For code generators, check each field individually, including less-obvious ones like file URIs [E3](https://bugbountylibrary.com/r/blog%3Ablog-3133700-xyz-bug-vertex-ai.md).

## Variants seen
- Prompt-injection to code execution: unsanitized question in prompt, model output run by Pyodide [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-f228-chmx-v6j6.md)
- Partial escaping in an agent tool: password and command escaped, username/host/port raw [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4c65-9gqf-4w8h.md)
- Code generator interpolating an image URI into a heredoc, breaking out with shell metacharacters [E3](https://bugbountylibrary.com/r/blog%3Ablog-3133700-xyz-bug-vertex-ai.md)

## Impact and severity
Led to remote code execution on the host or wherever generated code runs [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-f228-chmx-v6j6.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4c65-9gqf-4w8h.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-3133700-xyz-bug-vertex-ai.md). Severity is high because execution is arbitrary. It worsens when the sink runs with the app's privileges, when agent-ingested content is attacker-controlled, and when only some fields are escaped, giving a false sense of safety [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-4c65-9gqf-4w8h.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-f228-chmx-v6j6.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-4c65-9gqf-4w8h.md
- E3: https://bugbountylibrary.com/r/blog%3Ablog-3133700-xyz-bug-vertex-ai.md