MeridianMeridian

ChatGPT Vulnerability Allowed JavaScript Execution and Full Account Takeover via Shared Conversation Links

Security researchers at Parameter discovered a critical flaw in ChatGPT that enabled remote code execution in a logged-in user's browser simply by clicking a shared conversation link. The attack chain combined the platform's HTML preview rendering feature with the MathLive library's unvalidated postMessage handling and a YouTube oembed callback to bypass CSP restrictions. Successful exploitation granted attackers access to private conversations, the ability to open chats, and full control over the victim's account. OpenAI acknowledged the issue as P1 severity, deployed a server-side fix within eight days, and paid a $5000 Bug Bounty reward. No user action was required as the patch was applied centrally. The vulnerability stemmed from the interaction of otherwise secure components rather than a single isolated flaw.

ekurakTranslated from Polish

Read at source

Security researchers from the company Parameter have identified a serious vulnerability in the popular ChatGPT service operated by OpenAI. By using a link to a shared conversation, it was possible to execute malicious JavaScript code directly in the context of a logged-in user's session. No additional interaction or malware installation was required; simply clicking the potentially malicious link was sufficient.

The attack relied on executing malicious JavaScript code inside the user's browser. Opening a shared conversation link was all that was needed to trigger the exploit. Consequences ranged from exfiltration of private conversations to complete account takeover. OpenAI confirmed the vulnerability and deployed appropriate fixes. Researchers received a $5000 reward through the Bug Bounty program.

How the attack worked

Individual system components functioned correctly and securely on their own. Only their combination created an opportunity for an attacker to smuggle and execute JavaScript code on the user side. ChatGPT allows rendering of HTML blocks generated by the language model as small subpages via the Preview feature. Due to security policies, OpenAI runs this content in an isolated environment on a separate domain, preventing direct access to the main chat window.

However, the same conversation also contained an interactive chart generated with the MathLive mathematical library. This component used an on-screen keyboard that could send messages to the main chat window via the postMessage mechanism. Commands sent through postMessage were not validated in any way. MathLive did not check the sender (event.origin, event.source) or the message contents.

This allowed raw HTML code to be sent in the keyboard layout configuration field (update-setting). The Preview component then forwarded the received code directly to the main application window without warnings. To execute arbitrary JavaScript, the Content Security Policy had to be bypassed. Inline scripts were blocked, but the policy permitted loading scripts from the YouTube domain. Researchers used an oembed callback to force the browser to load malicious code under the guise of a trusted YouTube script.

With the injected script, an attacker could operate within the context of the logged-in user's session, access conversation contents, open private chats, and exfiltrate data to an external server. Researchers demonstrated proof-of-concept leakage of a private chat. Although further exploitation was halted after demonstrating arbitrary JavaScript execution, the flaw effectively enabled full account takeover.

After receiving the report, OpenAI confirmed the vulnerability, classified it as P1 severity, and deployed fixes within eight days. The $5000 Bug Bounty reward was paid, and engineers responded professionally throughout the process. No user-side actions are required as patches were applied on the provider's servers.

OpenAIChatGPTParameterMathLive
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

OpenSSH Patches Critical Password Authentication Bypass Affecting musl libc Systems
Vulns & Exploits

OpenSSH Patches Critical Password Authentication Bypass Affecting musl libc Systems

OpenSSH version 10.6p2 introduces a mitigation for a critical vulnerability that allows password authentication bypass on Linux systems using musl libc with PAM disabled. The flaw affects configurations where password verification relies directly on the C library rather than PAM, enabling remote attackers to log in without valid credentials if PasswordAuthentication remains enabled. Systems running Alpine Linux containers or distributions such as postmarketOS, Void Linux musl variant, and certain OpenWRT setups with OpenSSH instead of Dropbear are most exposed. Damien Miller explicitly recommends setting PasswordAuthentication=no or disabling SSH entirely on affected hosts until patched. The issue was reported by Özgün Kültekin of Wakefield and stems from behavior outside sshd itself, though the daemon serves as the attack vector. Alpine Linux quickly issued updated packages, while OpenSSH developers cited rapid AI-driven rediscovery of bugs as justification for short disclosure timelines. No public exploit details or CVE identifier have been released yet.

ekurakNov 5, 2026Translated from Polish

Remote Cyberattacks on European Refrigeration Units Escalate as French Blood Bank Targeted
Vulns & Exploits

Remote Cyberattacks on European Refrigeration Units Escalate as French Blood Bank Targeted

French authorities reported that remote attackers compromised refrigeration systems in three blood banks, raising internal temperatures from -30°C to 110°C. The affected units were internet-exposed Danfoss controllers that had not received security updates. Investigators determined that the attackers exploited a predictable administrator password derived from the current date, allowing unauthorized access without authentication. Once inside the systems, the threat actors altered temperature setpoints, placing blood supplies at immediate risk of spoilage. Responders isolated the compromised units and transferred all blood products to air-gapped refrigeration equipment. The same attack pattern had previously been observed against supermarket cold-storage installations across Europe. The incident highlights the growing exposure of industrial control systems that remain reachable from the public internet.

ekurakNov 5, 2026Translated from Polish

AI Agent Uncovers Backdoors with Password 123456 and Hardcoded Keys in Encrypted USB Drives
Vulns & Exploits

AI Agent Uncovers Backdoors with Password 123456 and Hardcoded Keys in Encrypted USB Drives

An AI-powered analysis has exposed critical flaws in multiple USB encryption and copy-protection products, including hardcoded administrator accounts and keys independent of user passwords. The research focused on devices from SecZure, Netac, KakaSoft, and Nexcopy, where fixed credentials such as 123456 and SECZURE.COM allowed full file decryption without the legitimate administrator password. In several cases the encryption key was extracted directly from the binary or configuration files, rendering user passwords irrelevant. The AI agent replicated months of prior manual reverse engineering in minutes using static analysis and Binary Ninja MCP. Weaknesses included the use of fast MD5 and HMAC-MD5 derivations, ECB mode without IVs, and fixed 32-byte AES keys embedded in executables. The findings highlight systemic problems in closed-source cryptographic products marketed for data protection and copy prevention.

HabrNov 2, 2026Translated from Russian