LiveActive security incident?Get immediate response
CVE Record

CVE-2026-73032: PapersGPT for Zotero 0.6.1 RCE via Unsanitized LLM Response eval()

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero's chrome-privileged context, enabling file read/write, process execution, and access to all Zotero data.

CriticalCVSS 9.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

PapersGPT for Zotero 0.6.1 can treat attacker-controlled AI output as trusted program code. A malicious PDF, intercepted API response, or hostile custom AI endpoint could compromise the user’s Zotero environment, exposing files and research data and potentially running processes on the computer.

Executive priority

Treat as an immediate remediation priority wherever the extension is installed. The potential impact reaches local files, processes, and all Zotero data. Prioritize researchers handling external documents or using custom LLM endpoints, while recognizing that active exploitation is not established by the supplied evidence.

Technical view

The extension passes an unsanitized LLM response to window.eval() in views.ts. Because execution occurs in Zotero’s chrome-privileged context, injected JavaScript may read or modify files, execute processes, and access Zotero data. The supplied CVSS 3.1 score is 9.6 with user interaction required and impacts crossing a security boundary.

Likely exposure

Systems are likely exposed where PapersGPT for Zotero 0.6.1 is installed and processes untrusted PDFs or responses from interceptable or untrusted LLM endpoints. The bundle inconsistently lists affected version “0” elsewhere, so confirm installed versions against vendor guidance and the patch history.

Exploitation context

The documented paths involve prompt injection embedded in PDFs, interception of LLM API traffic, or a malicious custom endpoint. The bundle marks KEV false and provides no evidence of active exploitation. Successful exploitation requires a user-associated workflow that causes the extension to process the malicious response.

Researcher notes

This is CWE-94 code injection at an AI trust boundary: model output reaches eval() without sanitization. The supplied attack vectors are credible design-level paths, but no proof of active exploitation is included. Version metadata conflicts between the title and affected-version field; validate scope using the repository, issue, pull request, and patch commit.

Mitigation direction

  • Apply a vendor-confirmed release containing patch commit 094134172ce4a344a31e4b196cc75d1806383658.
  • Until patched, disable PapersGPT where untrusted PDFs or LLM responses may be processed.
  • Restrict custom LLM endpoints to trusted services and protect API traffic from interception.
  • Review vendor issue 154 and pull request 155 for current remediation guidance.

Validation and detection

  • Inventory Zotero installations and identify the installed PapersGPT extension version.
  • Confirm deployed code no longer passes LLM-generated content to window.eval().
  • Verify the installed release includes or supersedes patch commit 094134172ce4a344a31e4b196cc75d1806383658.
  • Review endpoint configurations and transport protections for every configured LLM service.
  • Examine affected systems for unexpected file changes, process activity, or Zotero data access.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-94: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-73032 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.6 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.6CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H2.86VulnCheck
9.4CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——VulnCheck

Vulnerability scoring details

Base CVSS 4.0 score

9.4Critical
CVSS 4.0 vector shape for CVE-2026-73032Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
papersgptpapersgpt-for-zotero0affected
Weakness

CWE details

CWE-94

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-94 · source CWE mapping

Improper Control of Generation of Code ('Code Injection')

Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs