CVE-2026-73032: PapersGPT for Zotero RCE Vulnerability

CVE-2026-73032 Overview

CVE-2026-73032 is a remote code execution vulnerability in PapersGPT for Zotero version 0.6.1. The plugin passes unsanitized responses from a large language model (LLM) endpoint directly to window.eval() in views.ts. Attackers can trigger arbitrary JavaScript execution through prompt injection embedded in PDFs, machine-in-the-middle (MITM) interception of API traffic, or a malicious custom LLM endpoint. Because the code runs in Zotero's chrome-privileged context, exploitation grants file read/write, process execution, and full access to Zotero library data. The flaw is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Successful exploitation delivers arbitrary code execution in Zotero's chrome-privileged context, enabling file access, process launch, and exfiltration of research data.

Affected Products

PapersGPT for Zotero version 0.6.1
Zotero installations with the vulnerable PapersGPT plugin loaded
Any downstream fork bundling the unpatched src/modules/views.ts handler

Discovery Timeline

2026-08-11 - CVE-2026-73032 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73032

Vulnerability Analysis

PapersGPT for Zotero integrates LLM-generated responses into the Zotero user interface. In version 0.6.1, the plugin retrieves the LLM output via Meet.integratellms.getGPTResponse(text) and wraps the raw string inside a setTimeout callback executed by window.eval(). No parsing, sandboxing, or output validation occurs before evaluation.

Because Zotero extensions run in the chrome-privileged context of the host application, evaluated JavaScript has access to privileged APIs. Attackers can read arbitrary files, spawn processes, and manipulate the Zotero database. The trust boundary between LLM output and executable code is absent, turning any influence over the model response into full code execution.

Root Cause

The root cause is direct evaluation of untrusted third-party data. LLM responses are treated as safe code rather than untrusted content, violating [CWE-94]. Any mechanism that shapes the LLM output — prompt injection, response tampering, or endpoint substitution — becomes an execution primitive.

Attack Vector

Three practical attack paths exist. First, an attacker embeds hidden prompt-injection instructions in a PDF that a researcher opens and queries through PapersGPT, causing the LLM to return JavaScript payloads. Second, an on-path attacker intercepts LLM API traffic and rewrites responses to include malicious code. Third, a user is socially engineered into configuring a custom LLM endpoint controlled by the attacker, which returns weaponized JavaScript on every request.

typescript

     text = await Meet.integratellms.getGPTResponse(text) as string
     this.dotsContainer?.classList.remove("loading")
     if (text.trim().length) {
-      try {
-        window.eval(`
-          setTimeout(async () => {
-            ${text}
-          })
-        `)
-        popunWin.createLine({ text: "Code is executed", type: "success" })
-      } catch { }
       popunWin.createLine({ text: "Done", type: "success" })
     } else {
       popunWin.createLine({ text: "Done", type: "fail" })

Source: GitHub commit 0941341 — the patch removes the window.eval() call entirely.

Detection Methods for CVE-2026-73032

Indicators of Compromise

Zotero process spawning child processes such as cmd.exe, powershell.exe, bash, or sh shortly after PapersGPT queries
Unexpected outbound network connections initiated by the Zotero binary to non-LLM endpoints
Modifications to files outside the Zotero data directory that correlate with PapersGPT session activity
PapersGPT configured with a custom LLM base URL pointing to unknown or newly registered domains

Detection Strategies

Inventory endpoints for PapersGPT plugin installations and flag any instance pinned to version 0.6.1 or earlier
Monitor the Zotero process tree for anomalous child processes or scripting host invocations
Inspect HTTP(S) traffic from Zotero for LLM responses containing JavaScript keywords such as require(, Components.classes, or ChromeUtils.import

Monitoring Recommendations

Enable process creation logging on hosts where researchers use Zotero and forward events to a centralized SIEM
Alert on Zotero-initiated file writes to sensitive paths, including SSH keys, browser profiles, and credential stores
Track configuration changes to PapersGPT preferences, particularly custom endpoint URLs and API keys

How to Mitigate CVE-2026-73032

Immediate Actions Required

Upgrade PapersGPT for Zotero to the release that merges pull request #155, which removes the window.eval() call
Restrict PapersGPT to trusted, first-party LLM endpoints and revoke any custom endpoint configurations set by end users
Audit recent PapersGPT sessions and PDFs processed by researchers for signs of prompt-injection payloads

Patch Information

The fix is delivered in commit 0941341, merged via pull request #155. The patch removes the window.eval() invocation in src/modules/views.ts so that LLM responses are no longer executed as JavaScript. Users should update to the fixed version and validate that the vulnerable code path is absent from their installed plugin. See the VulnCheck advisory and issue #154 for additional context.

Workarounds

Disable or uninstall the PapersGPT plugin until the patched release is deployed
Force PapersGPT to use only vetted LLM providers over TLS with certificate pinning where feasible to prevent MITM tampering
Educate users to avoid opening untrusted PDFs through PapersGPT and to reject prompts requesting custom LLM endpoint configuration

bash

# Verify installed PapersGPT version and remove vulnerable release
ls ~/Zotero/extensions/ | grep -i papersgpt
# Remove the plugin directory or .xpi until the patched version is installed
rm -rf ~/Zotero/extensions/papersgpt*