CVE-2025-43714

Published May 19, 2025

Last updated 2 days ago

ChatGPT

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-43714 is a vulnerability in the ChatGPT system that stems from its handling of SVG (Scalable Vector Graphics) documents. Specifically, ChatGPT performs inline rendering of SVG documents instead of treating the code as text (for example, rendering it inside a code block). This behavior, present up to March 30, 2025, enables HTML injection within modern web browsers. Attackers can exploit this vulnerability by embedding malicious SVG files within shared conversations. These SVG files can contain embedded JavaScript that executes when the image is rendered, potentially leading to cross-site scripting (XSS) attacks. This could allow unauthorized script execution, potentially compromising user sessions, stealing sensitive information, or performing unauthorized actions within the web application.

Description: The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a code block), which enables HTML injection within most modern graphical web browsers.
Source: cve@mitre.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.5
Impact score: 2.5
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-77

Hype score: Not currently trending

References