The original text is in EN, taken from the source site. Source ↗

Researchers found a chain of flaws that turned an ordinary public ChatGPT share link into attacker-controlled JavaScript running inside the victim’s signed-in session.

OpenAI fixed the issue on October 26 and classified it as P1. The Parameter researchers’ full technical write-up says the bug earned a $5,000 bounty.

An attacker published a crafted conversation using ChatGPT’s sharing feature, and the victim only needed to click the link to be affected. Although ChatGPT’s HTML Preview feature runs untrusted code in a restricted frame on a different web address, that isolation was effective. The vulnerability, however, was in another component of the main page.

The conversation included an interactive graph that loaded the MathLive math library. MathLive installed a postMessage listener in the main page for its on-screen keyboard.

This listener accepted an update-setting message from any origin and failed to check which window sent it. As a result, the message could replace the keyboard layout with raw HTML.

Controlled proof that private conversation data could leave the victim’s session (Source: Parameter)

The Preview code sent two messages: the first provided the layout, and the second instructed MathLive to display the keyboard. MathLive then inserted the attacker’s markup into the page using innerHTML.

The createHTML helper marked the string as trusted but did not sanitize it. To execute scripts, the researchers injected an unsandboxed srcdoc iframe, which inherited the chatgpt.com identity and could interact with the parent page.

ChatGPT’s Content Security Policy (CSP)blocked inline scripts but allowed scripts from YouTube. YouTube’s oEmbed endpoint reflected a JSONP callback parameter in its response before returning a validation error. Ending the callback with ;void neutralized the appended error object, allowing the browser to execute the attacker’s code as a trusted script.

The injected code accessed the session token and account ID from the page. It then listed recent conversations through the /backend-api/conversations endpoint and retrieved a private chat the attacker was not authorized to access. An image request sent a small piece of that data to a server controlled by a researcher. In principle, the code could perform any action that the victim could take.

In the most stable test, simply opening the link was the only click required, and the payload executed after approximately 4.5 seconds. OpenAI elevated the severity from P2 to P1 after reproducing it on October 21. By October 26, both web frontends had rejected the cross-frame MathLive messages.

Threat actors already abuse legitimate ChatGPT shared links to host ClickFix lures that lead to a NetSupport RAT. Flaws like this one make shared links an even more attractive delivery route.

Defensive lessons

  • Receivers should verify both event.origin and event.source before accepting state-changing messages.
  • Cross-window settings should never carry raw HTML.
  • Documents built from untrusted content should stay sandboxed.
  • CSP should be a backup control, not the only barrier.

Credential theft against OpenAI users is also active, with phishing campaigns targeting OpenAI accounts across work and personal logins. A patched ChatGPT guardrail bypass flaw also showed how a file download mechanism could expose local file inclusion risk. Treat every shareable AI surface as attacker-reachable input.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.