2026年10月31日 - 链接博客
We Told Over ChatGPT counts (via) Parameter Labs 描述他们发现的与 ChatGPT 执行文物图案(OpenAI曾称此"Canvas"，但看起来是最新版本称为 HTML 预览，其中交互式自定义 HTML apps 被显示在一个沙盒的iframe上。
重要的是，这些中的HTML必须紧紧地放入沙盒来避免与OpenAI API进行不可信的代码交互并访问私人数据。
参数发现了相当复杂的攻击链。 OpenAI 使用 MathLive JavaScript 库作为其图支持的一部分，该库包括自己的虚拟键盘，可以通过从沙盒化的iframe () 从后Message () 在母页中被触发。
接收消息的代码使用内置HTML，所以发送消息的任何东西都可以给母程序添加自定义的HTML——并且没有防止包括HTML预览框在内的其他沙盒框调用这种方法的机制。
这意味着在iframe中不信任的代码可以插入HTML，虽然内置HTML不直接执行脚本元素，但可以用来注入新的iframe而不受沙盒限制。
OpenAI的CSP规则完全屏蔽了内置脚本，只允许从少数域中装入脚本，但其中之一是YouTube — — 而YouTube oEmbed端点可以用来以执行的方式回想JavaScript.
攻击一旦在ChatGPT上有JavaScript执行，从API中取出私人用户数据并通过图像引用将其分解，是微不足道的。
最终结果：您可以创建 ChatGPT 共享 URL，当另一个登录用户访问时，可以过滤他们的私人数据或代表他们采取行动。
OpenAI关闭了洞，并支付了5000元的bug赏金，我认为对于如此严重的弱点来说，这有点便宜。
最近的文章
- 10月 inflection分用于平面游戏开发 - 2026年10月28日
- Battle Drones - 一种带有音频多人游戏机的被编码为RTS的氛围 - 2026年10月20日
- 你好 Python 3.15 再见3.10 现在我可以用到3.11 - 2026年10月12日
- 我博客的新内容，用我的声音打造 - 2026年10月9日
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
31st October 2026 - Link Blog
How We Took Over ChatGPT Accounts (via) Parameter Labs describe an exploit they found against ChatGPT's implementation of the artifacts pattern (OpenAI used to call this "Canvas" but it looks like the latest revision is called HTML previews), where interactive custom HTML apps are displayed in a sandboxed iframe.
It's important that HTML in these stays tightly sandboxed to avoid untrusted code interacting with OpenAI APIs and accessing private data.
Parameter found quite a complex attack chain. OpenAI use the MathLive JavaScript library as part of their graph support, and that library includes its own virtual keyboard, which can be triggered in the parent page via postMessage() from the sandboxed iframe.
That message receiving code uses innerHTML, so anything that sends a message can add custom HTML to the parent - and there was no mechanism to prevent other sandboxed frames, including HTML preview frames, from calling that method.
This meant untrusted code in an iframe could insert HTML, and while innerHTML doesn't directly execute script elements it could be used to inject a new iframe without sandbox restrictions.
OpenAI’s CSP rules blocked inline scripts entirely, and only allowed script loading from a handful of domains, but one of those was YouTube - and the YouTube oEmbed endpoint could be used to reflect JavaScript back in a way that executed it.
Once the attack had JavaScript execution on ChatGPT, it was trivial to fetch private user data from APIs and exfiltrate it via an image reference.
The end result: you could create a ChatGPT share URL which, when visited by another signed-in user, could exfiltrate their private data or take actions on their behalf.
OpenAI closed the hole and paid out a $5,000 bug bounty, which I think was a bit cheap for a vulnerability this serious.
Recent articles
- The October inflection point for vibe game development - 28th October 2026
- Battle Drones - a vibe coded RTS with audio-based multiplayer - 20th October 2026
- Hello Python 3.15, goodbye 3.10, and now I can use 3.11 - 12th October 2026
- A new feature for my blog, built using my voice - 9th October 2026
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.