Researchers say a public ChatGPT share link could run code in a victim's session; OpenAI fixed it on October 26

The security firm Parameter published a write-up on October 28 saying its researchers found a way to run attacker-controlled JavaScript inside the signed-in ChatGPT session of anyone who opened a public conversation share. OpenAI fixed the issue on October 26 and classified the report as P1, according to the write-up.

Parameter's account of the chain:

• A malicious conversation combines a normal interactive graph, which loads the MathLive math library and installs a message listener in the main chatgpt.com page, with an HTML Preview that sends it messages. The listener did not check who sent a message that changes the virtual keyboard layout, and the layout could hold raw HTML.
• That HTML created an unsandboxed frame carrying the chatgpt.com identity. ChatGPT's content security policy blocked inline scripts but allowed YouTube, and a YouTube oEmbed endpoint that echoed a callback parameter supplied the script.
• The researchers say the code could list the victim's conversations, read a private conversation that had never been shared, and send part of it to an outside server. They say the same access would allow any action the victim's account can take. Opening the share link, with at most one click on Preview, was all it needed.

Parameter's timeline: it submitted the report on October 18, OpenAI raised the severity from P2 to P1 on October 21, a fix reached the two web frontends in stages, and on October 26 OpenAI confirmed both rejected the reported messages and awarded a $5,000 bounty. The account is the researchers' own; the write-up does not describe any use of the flaw against real users.