A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read private conversations, researchers at security firm Parameter showed.
The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.
OpenAI's CSP rules blocked inline scripts but allowed script loading from YouTube, and the YouTube oEmbed endpoint could be used to reflect JavaScript back in a way that executed it.
Once the attacker's code ran inside the victim's signed-in session, it could list recent conversations, open a private chat that had never been shared, and send a portion of it to a server controlled by the researchers.
