PT-2025-21945 · Chatgpt · Chatgpt

Zer0Dac · Published 2025-05-19 · Updated 2025-06-12 · CVE-2025-43714

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ChatGPT system through 2025-03-30

Description: The issue allows HTML injection within most modern graphical web browsers due to the inline rendering of SVG documents. This is instead of rendering them as text inside a code block.

Recommendations: For the ChatGPT system through 2025-03-30, consider disabling inline rendering of SVG documents as a temporary workaround until a patch is available. Restrict access to SVG rendering to minimize the risk of HTML injection.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-43714

Affected Products

Chatgpt

References · 9

• 🔥 https://medium.com/@zer0dac/chatgpt-a-potential-phishing-vector-via-html-injection-bf703c79590a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-43714 · Security Note
• https://osv.dev/vulnerability/CVE-2025-43714 · Vendor Advisory
• https://twitter.com/dailycve/status/1933224048823279752 · Twitter Post
• https://twitter.com/grok/status/1924891141604094307 · Twitter Post
• https://twitter.com/CVEnew/status/1924484876696248725 · Twitter Post
• https://twitter.com/SecurityJoes/status/1925069268569248209 · Twitter Post
• https://twitter.com/FindSecCyber/status/1924723053579157992 · Twitter Post
• https://twitter.com/dailytechonx/status/1924891622929793151 · Twitter Post