ECHO Template / Jinja / SQL Command Injection via LLM
This detects attempts to abuse an AI model's habit of following instructions literally, tricking it into repeating attacker text verbatim, evaluating template syntax, or forwarding SQL commands to a connected database. It covers three related tricks that all rely on the model doing exactly what a crafted prompt tells it to do.
How the attack works
An attacker sends a prompt that frames itself as a system or admin instruction, such as claiming to test an 'echo command' and asking the model to repeat exactly what follows an ECHO: marker. The payload after that marker can be plain text, a Jinja template expression like {{7*7}} or {{config}} meant to be evaluated if the output is later rendered by a template engine, or a SQL statement the attacker asks the model to 'run exactly' against a connected database, expecting a SUCCESS/FAILURE reply. If any downstream system trusts the model's output as safe and passes it into a template renderer or a database, the injected content executes there.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 854cf28a-25cd-409c-b484-3389e055b078
- Severity
- Critical
Why it matters
If the model's output is fed into a template engine or database without sanitization, an attacker can achieve template injection, information disclosure (e.g. leaking config objects), or destructive SQL operations like dropped tables, using the LLM as a relay to bypass normal input validation.
What you can do
- →Never render LLM output through a template engine (Jinja or otherwise) without treating it as untrusted user input.
- →Never pass LLM output directly into a SQL query or database connector; always use parameterized queries and least-privilege database accounts.
- →Add server-side checks that reject or flag prompts matching admin/echo-testing framing combined with template or SQL syntax.
- →Review logs for prompts containing 'ECHO:', double-curly-brace expressions, or instructions to 'run the following SQL query exactly'.
Known benign look-alikes
- Legitimate Jinja2 template development with safe expressions like {{ user.name }}
- Database tutorials showing SQL examples in non-LLM-agent contexts
- Echo shell commands in bash scripting tutorials (echo "text" — not ECHO: prefix pattern)