The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps.
Date: 2024-07
Attack vector: other
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2024-40594
CWE: CWE-312
CVSS: 2.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)

The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps.


Mitigations:

Architectural layers (MAESTRO):