Vulnerability
A flaw in ChatGPT allowed accounts to be attacked via a share link.
Visiting the link by a logged-in user could expose their private data or allow actions in their name.
According to Parameter Labs, an HTML iframe could inject HTML code into the main page.
YouTube's oEmbed endpoint allowed JavaScript to be executed despite ChatGPT's CSP rules.
OpenAI fixed the flaw and paid a $5,000 bounty.