PapersGPT for Zotero RCE Exposed Through Unsanitized LLM Output

A high-severity remote code execution flaw tracked as CVE-2026-73032 was disclosed in PapersGPT for Zotero affecting versions up to and including 0.6.1. The bug stems from passing untrusted LLM-generated content to window.eval() in views.ts, allowing arbitrary JavaScript execution inside Zotero's chrome-privileged context. Reported attack paths include prompt injection embedded in PDFs, man-in-the-middle tampering with API responses, and malicious custom LLM endpoints, with potential impact including file read/write access, process execution, and exposure of all Zotero data.

The maintainers addressed the issue by merging pull request #155, which removed window.eval from the execTag functionality and replaced another eval-based regex path with safer handling using new RegExp(...). The fix was merged into the main branch and tagged in papersgpt-v1.1.0, while public advisories classified the weakness as CWE-94 and noted proof-of-concept exploitation with high confidentiality, integrity, and availability impact.