Address OWASP Top 10 A03 Injection per OWASP Top 10:2025. Injection occurs when untrusted data is sent to an interpreter as part of a command or query enabling SQL injection + NoSQL injection + LDAP injection + OS command injection + ORM injection + XML/XPath injection + Server-Side Template Injection (SSTI) + Cross-Site Scripting (XSS) + and other injection variants. Mitigations include (a) validate + sanitise + escape input at trust boundaries + (b) use parameterised queries + prepared statements + ORM safe-query APIs against SQL/NoSQL injection + (c) use context-appropriate output encoding against XSS (HTML + URL + JS + CSS encoding) + (d) implement Content Security Policy + Trusted Types + (e) validate file uploads (type + size + content + scanning) + (f) protect against XXE + deserialisation + template injection via safe parser configuration.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.