2026年10月31日 - 链接博客
We Told Over ChatGPT Accounts (通过) 参数实验室描述他们发现的对ChatGPT执行文物图案(OpenAI曾称这个"Canvas")的利用，但看起来最新版本叫做HTML预览，其中交互式自定义的HTML应用在沙盒的iframe中显示。
重要的是，HTML在这些中必须保持紧凑的沙盒，以避免与OpenAI API进行不信任的代码交互并访问私人数据。
参数发现了相当复杂的攻击链。 OpenAI 使用 MathLive JavaScript 库作为其图支持的一部分，该库包括自己的虚拟键盘，可以通过来自沙盒iframe的后Message()在母页中触发。
接收消息的代码使用内置HTML，所以发送消息的任何东西都可以给母程序添加自定义的HTML——并且没有防止包括HTML预览框在内的其他沙盒框调用这种方法的机制。
这意味着一个iframe中的不可信代码可以插入HTML，虽然内HTML不直接执行脚本元素，但可以用来注入一个新的iframe而不受沙盒限制。
OpenAI的CSP规则完全屏蔽了内置脚本，只允许从少数域装入脚本，但其中之一是YouTube — — 而YouTube oEmbed端点可以用来以执行的方式反射JavaScript。
一旦攻击在ChatGPT上有JavaScript执行，从API中获取私用用户数据并通过图像参考将其解密是微不足道的。
最终结果：您可以创建 ChatGPT 共享 URL，当另一个登录用户访问时，可以过滤他们的私人数据或代表他们采取行动。
OpenAI关闭了这个洞，并支付了5000元的bug赏金，我认为对于如此严重的弱点来说，这有点便宜。
最近的文章
- 10月 inflection点用于氛围游戏开发 - 2026年10月28日
- Battle Drones - 一种带有音频多人游戏机的声调编码的RTS - 2026年10月20日
-你好派森 3.15 再见 3.10 现在我可以使用3.11 - 2026年10月12日
- 用我的声音打造的博客的新功能 - 2026年10月9日
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
31st October 2026 - Link Blog
How We Took Over ChatGPT Accounts (via) Parameter Labs describe an exploit they found against ChatGPT's implementation of the artifacts pattern (OpenAI used to call this "Canvas" but it looks like the latest revision is called HTML previews), where interactive custom HTML apps are displayed in a sandboxed iframe.
It's important that HTML in these stays tightly sandboxed to avoid untrusted code interacting with OpenAI APIs and accessing private data.
Parameter found quite a complex attack chain. OpenAI use the MathLive JavaScript library as part of their graph support, and that library includes its own virtual keyboard, which can be triggered in the parent page via postMessage() from the sandboxed iframe.
That message receiving code uses innerHTML, so anything that sends a message can add custom HTML to the parent - and there was no mechanism to prevent other sandboxed frames, including HTML preview frames, from calling that method.
This meant untrusted code in an iframe could insert HTML, and while innerHTML doesn't directly execute script elements it could be used to inject a new iframe without sandbox restrictions.
OpenAI’s CSP rules blocked inline scripts entirely, and only allowed script loading from a handful of domains, but one of those was YouTube - and the YouTube oEmbed endpoint could be used to reflect JavaScript back in a way that executed it.
Once the attack had JavaScript execution on ChatGPT, it was trivial to fetch private user data from APIs and exfiltrate it via an image reference.
The end result: you could create a ChatGPT share URL which, when visited by another signed-in user, could exfiltrate their private data or take actions on their behalf.
OpenAI closed the hole and paid out a $5,000 bug bounty, which I think was a bit cheap for a vulnerability this serious.
Recent articles
- The October inflection point for vibe game development - 28th October 2026
- Battle Drones - a vibe coded RTS with audio-based multiplayer - 20th October 2026
- Hello Python 3.15, goodbye 3.10, and now I can use 3.11 - 12th October 2026
- A new feature for my blog, built using my voice - 9th October 2026
Auto-fetched and translated by AI Atlas. All rights belong to the original author.