# ECHO Template / Jinja / SQL Command Injection via LLM

- **Severity:** Critical
- **Signature ID:** `854cf28a-25cd-409c-b484-3389e055b078`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This detects attempts to abuse an AI model's habit of following instructions literally, tricking it into repeating attacker text verbatim, evaluating template syntax, or forwarding SQL commands to a connected database. It covers three related tricks that all rely on the model doing exactly what a crafted prompt tells it to do.

## How the attack works

An attacker sends a prompt that frames itself as a system or admin instruction, such as claiming to test an 'echo command' and asking the model to repeat exactly what follows an ECHO: marker. The payload after that marker can be plain text, a Jinja template expression like {{7*7}} or {{config}} meant to be evaluated if the output is later rendered by a template engine, or a SQL statement the attacker asks the model to 'run exactly' against a connected database, expecting a SUCCESS/FAILURE reply. If any downstream system trusts the model's output as safe and passes it into a template renderer or a database, the injected content executes there.

## Why it matters

If the model's output is fed into a template engine or database without sanitization, an attacker can achieve template injection, information disclosure (e.g. leaking config objects), or destructive SQL operations like dropped tables, using the LLM as a relay to bypass normal input validation.

## What you can do

- Never render LLM output through a template engine (Jinja or otherwise) without treating it as untrusted user input.
- Never pass LLM output directly into a SQL query or database connector; always use parameterized queries and least-privilege database accounts.
- Add server-side checks that reject or flag prompts matching admin/echo-testing framing combined with template or SQL syntax.
- Review logs for prompts containing 'ECHO:', double-curly-brace expressions, or instructions to 'run the following SQL query exactly'.

## Known benign look-alikes

- Legitimate Jinja2 template development with safe expressions like {{ user.name }}
- Database tutorials showing SQL examples in non-LLM-agent contexts
- Echo shell commands in bash scripting tutorials (echo "text" — not ECHO: prefix pattern)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00277
- https://github.com/NVIDIA/garak/blob/main/garak/probes/exploitation.py
- https://cwe.mitre.org/data/definitions/94.html
- https://cwe.mitre.org/data/definitions/89.html

---
Source: https://www.netzilo.com/threats/atr-echo-template-jinja-sql-command-injection-via-llm