ChatGPT share links could run code in a signed-in session
Original title: A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
Parameter reported the P1 issue on October 18; OpenAI fixed both web frontends by October 26 and paid $5,000.
Researchers at Parameter showed a shared ChatGPT link could execute an attacker's code in the session of a logged-in user who opened it, including reading private chats. The chain used Preview plus a MathLive message listener that accepted raw HTML from any frame, then a YouTube-hosted script allowed by content security policy. OpenAI reproduced the proof, raised it from P2 to P1, and deployed a fix. Parameter says it saw no real-world use, and users have nothing to install.
Unconfirmed: Parameter reports no real-world use and tested only between its own accounts.
- The most reliable version required one click on Preview; a later version opened Preview automatically.
- The test listed recent chats and sent part of an unshared chat to a researcher server.
- By October 26 both ChatGPT web frontend versions rejected the messages used.
- Parameter published the writeup on October 28, after the fix.
- OpenAI paid $5,000 through its bug bounty program.
Impact: Code execution in the victim's ChatGPT session and private chat access
| Product | Affected | Fixed in |
|---|---|---|
| OpenAI ChatGPT | — | Both web frontend versions by October 26 |
- 1.No user action is required; OpenAI says the fix is server-side.
From the original article
3 min read at thehackernews.com
A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.