CWE-1426Base

Improper Validation of Generative AI Output

Incomplete in the CWE catalog · 1 CVE mapped

1
CVEs mapped
3.0
Median CVSS
What it is

The product invokes a generative AI/ML

component whose behaviors and outputs cannot be directly

controlled, but the product does not validate or

insufficiently validates the outputs to ensure that they

align with the intended security, content, or privacy

policy.

Recent examples
3.0cvss
CVE-2025-31363

Data exfiltration via AI plugin Jira tool

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.

LOWno explanation yet
0%
epss
The record
Technical detail
CWE ID
CWE-1426
Abstraction
Base
Structure
Simple
Status
Incomplete
References (5)
https://genai.owasp.org/llmrisk/llm02-insecure-output-handling/https://cohere.com/blog/validating-llm-outputshttps://aclanthology.org/2023.emnlp-demo.40/https://learn.snyk.io/lesson/insecure-input-handling/https://arxiv.org/pdf/2402.01822