Amazon QDetector Library Sign in to Amazon Q

Amazon Q

Detector Library

JavaScript detectors (95/95)

Improper access control Sensitive data stored unencrypted due to partial encryption Pseudorandom number generators OS command injection URL redirection to untrusted site Improper Output Handling Integer overflow Protection mechanism failure Non-literal regular expression Tainted input for Docker API Usage of an API that is not recommended XML external entity Server-side request forgery New function detected Stack trace exposure Timing attack SNS don't bind subscribe and publish Invoke super appropriately NoSQL injection Improper handling of case sensitivity Hardcoded credentials Lazy Load Module Insecure cookie Cross-site scripting Use {} instead of new Object()Hardcoded IP address AWS credentials logged Sensitive query string XPath injection Data loss in a batch request Path traversal Least privilege violation DNS prefetching Resource leak Insufficiently protected credentials File extension validation Insecure connection using unencrypted protocol Cross-site request forgery Set SNS Return Subscription ARN File and directory information exposure Missing Amazon S3 bucket owner condition Insecure hashing Numeric truncation error Client-side KMS reencryption Clear text credentials AWS client not reused in a Lambda function LDAP injection Batch request with unchecked failures Items removed from an array using delete Cryptographic key generator Unauthenticated Amazon SNS unsubscribe requests might succeed Improper Synchronization Unverified hostname Avoid Undefined As Variable Name Origins-verified cross-origin communications Loose file permissions Unsanitized input is run as code Alert Box JS Rule Untrusted Amazon Machine Images File Race Bad Improper certificate validation Insecure CORS policy Redundant switch statement Unbounded LLM Output Deserialization of untrusted object Sensitive information leak Index of method comparison Check failed records when using kinesis Weak obfuscation of web requests Catch and swallow exception Logging of sensitive information Limit request length String passed to `setInterval` or `setTimeout`Improper Initialization Untrusted data in security decision Missing check on method output Log injection Override of reserved variable names in a Lambda function Improper restriction of rendered UI layers or frames Insecure cryptography Insecure object attribute modification Session fixation Type confusion Avoid nan in comparison Improper input validation Disabled HTML autoescape Use of a deprecated method Unvalidated expansion of archive files File injection Sendfile injection SQL injection Header injection Insecure temporary file or directory Vector embedding weaknesses Inefficient polling of AWS resource

Unbounded LLM Output High

LLM completion calls without proper constraints - such as an output token cap, a request timeout, input-size validation, or rate limiting - can consume resources without bound. An attacker who can influence the prompt can induce maximum-length generation or long-running requests, driving cost amplification and latency exhaustion that degrades availability for other callers. Remediate by setting an explicit output cap (max_tokens or max_completion_tokens for OpenAI-compatible clients, maxTokens under inferenceConfig for Bedrock Converse, max_output_tokens for Gemini and Vertex AI, num_predict for Ollama), configuring a request timeout, validating and bounding input size, and applying rate limiting.

Detector ID

javascript/unbounded-llm-output@v1.0

Category

Common Weakness Enumeration (CWE)

CWE-400 CWE-770

Tags