一句话：提出静态污点分析框架 TaintP2X，将 LLM 输出视为污点源，检测 LLM 集成应用中的 P2Xi 注入漏洞。
LLM 集成应用通过工具调用可执行文件系统访问、代码执行和数据库查询等敏感操作，若未经验证直接使用 LLM 生成输出，会引入 Prompt-to-Anything 注入（P2Xi）漏洞，导致远程命令执行、文件注入、SQL 注入和 SSRF 等严重后果。本文提出 TaintP2X，一种静态污点分析框架，将 LLM 生成输出建模为污点源，跟踪其向敏感 sink 函数的传播，并利用 LLM 辅助分析削减误报。在包含 35 个 P2Xi 漏洞的真值数据集上，TaintP2X 取得 77.1% 的召回率，优于现有方法；在 75 个开源仓库中发现 101 条污点路径，7 个漏洞获开发者确认，其中 5 个已修复。
Large Language Models (LLMs) have revolutionized numerous domains, enabling the development of LLM-integrated applications that autonomously plan and act through tool calling. While these applications demonstrate remarkable capabilities, their ability to invoke sensitive operations, such as file system interactions, code execution, and database queries, introduces critical security risks. In particular, prompt injection vulnerabilities, combined with security-sensitive sink functions, can lead to a broad class of attacks we define as Prompt-to-Anything Injection (P2Xi). These vulnerabilities, stemming from the misuse of LLM-generated outputs without proper validation, can result in severe consequences such as Remote Command Execution (RCE), file injection, SQL injection, and Server-Side Request Forgery (SSRF). To address this emerging threat, we propose TaintP2X, a novel static taint analysis framework that models LLM-generated outputs as taint sources, tracks their propagation through sensitive sink functions, and employs LLM-assisted analysis to prune false positives. TaintP2X achieves high precision and scalability, systematically identifying P2Xi vulnerabilities. In evaluations, TaintP2X demonstrated a 77.1% recall on a ground truth dataset of 35 P2Xi vulnerabilities, outperforming state-of-the-art methods. With TaintP2X, we have uncovered 101 taint paths across 75 open source repositories, with 7 vulnerabilities confirmed by developers, and 5 of them fixed. These findings highlight the prevalence and impact of P2Xi vulnerabilities and establish TaintP2X as a practical solution for securing LLM-integrated ecosystems.
@inproceedings{paperbot11548,
title = {TaintP2X: Detecting Taint-Style Prompt-to-Anything Injection Vulnerabilities in LLM-Integrated Applications},
author = {Junjie He and Shenao Wang and Yanjie Zhao and Xinyi Hou and Zhao Liu and Quanchen Zou and Haoyu Wang},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773199}
}