A critical (CVSS 9.6) code injection flaw in PapersGPT for Zotero lets attacker-controlled LLM output reach window.eval(), granting arbitrary code execution inside Zotero's chrome-privileged context.
What Is It
PapersGPT for Zotero version 0.6.1 contains a remote code execution vulnerability (CWE-94, improper control of code generation). Responses returned from an LLM endpoint are passed unsanitized to window.eval() in views.ts, so any attacker who can influence that response can execute arbitrary JavaScript.
The NVD record lists three practical exploitation paths: prompt injection embedded in a PDF the user opens, MITM interception of API requests to the LLM provider, and a malicious custom LLM endpoint configured in the plugin.
Why It Matters
Execution lands in Zotero's chrome-privileged context; not a sandboxed page. Per the advisory, that enables file read and write, process execution, and access to all Zotero data.
CVSS v3.1 scores it 9.6 CRITICAL (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H): network attack vector, low complexity, no privileges required, user interaction required, and a changed scope reflecting the escape beyond the plugin's own boundary. The CVSS v4.0 score is 9.4 CRITICAL, with high impact across both vulnerable and subsequent systems.
CISA's SSVC assessment marks exploitation as poc (proof-of-concept available), automatable no, and technical impact total. The prompt-injection vector is notable: a researcher only has to open a hostile PDF in a tool built to read untrusted documents.
There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor/product: papersgpt / papersgpt-for-zotero
- Affected versions: all versions up to and including 0.6.1 (semver, default status affected)
Patch Status
The NVD record references upstream remediation work: GitHub issue #154, pull request #155, and commit 0941341. Users of PapersGPT for Zotero should update past 0.6.1 to a build containing that commit. No specific required-action deadline is present in the supplied data. In the interim, avoid untrusted PDFs and unverified custom LLM endpoints.
Sources
- NVD, CVE-2026-73032: https://nvd.nist.gov/vuln/detail/CVE-2026-73032
- VulnCheck Advisory; PapersGPT for Zotero RCE via Unsanitized LLM Response Eval: https://www.vulncheck.com/advisories/papersgpt-for-zotero-rce-via-unsanitized-llm-response-eval
- PapersGPT for Zotero; Repository: https://github.com/papersgpt/papersgpt-for-zotero
- Issue #154: https://github.com/papersgpt/papersgpt-for-zotero/issues/154
- Pull Request #155: https://github.com/papersgpt/papersgpt-for-zotero/pull/155
- Fix Commit
0941341: https://github.com/papersgpt/papersgpt-for-zotero/commit/094134172ce4a344a31e4b196cc75d1806383658