Loading vulnerability…
RCE in PapersGPT for Zotero via unsanitized LLM response eval
CVE-2026-73032 is a remote code execution vulnerability in PapersGPT for Zotero affecting versions up to and including 0.6.1. The flaw is caused by passing untrusted output returned from an LLM endpoint directly into window.eval() in views.ts, including in the execTag code path, without sanitization or safe parsing. Because the evaluated JavaScript executes within Zotero's chrome-privileged context, attacker-controlled LLM responses can escape normal content restrictions and run arbitrary code with the extension's elevated privileges. Reported exploitation paths include prompt injection embedded in PDFs processed by the plugin, interception and modification of API responses in transit, and use of a malicious custom LLM endpoint. A related fix removed the vulnerable eval usage and replaced separate regex-related eval handling with safer construction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary JavaScript execution in Zotero's chrome-privileged context. This can provide effective remote code execution with high impact to confidentiality, integrity, and availability, including reading and writing local files accessible to Zotero, executing processes, and accessing or manipulating all data available to the Zotero application and the vulnerable extension.
If you can’t patch tonight, do this now.
Until a patched version is installed, disable or uninstall the vulnerable PapersGPT for Zotero extension. Do not use the extension with untrusted PDFs or other attacker-influenced document content that could drive prompt injection into LLM responses. Avoid untrusted or custom LLM endpoints unless they are fully controlled and trusted, and protect API traffic against interception or modification with properly validated transport security and trusted network paths. Restrict extension use to trusted content and trusted model backends only.
Patch, then assume compromise.
Upgrade to a fixed release that removes evaluation of untrusted LLM output and replaces unsafe dynamic code execution with safe parsing or explicit logic. The vulnerable eval usage in the execTag path should be eliminated, and any additional dynamic evaluation patterns, including regex-related eval handling, should be replaced with safer alternatives such as direct RegExp construction where appropriate. If no fixed packaged release is available, remove or disable PapersGPT for Zotero 0.6.1 until an updated version is deployed.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.