PapersGPT for Zotero CVE-2026-73032

Exploitation requires that the victim actually invoke PapersGPT's LLM interaction (UI:A) on attacker-influenced input, and that the attacker control the text returned by the LLM endpoint via one of three named vectors: (1) prompt injection embedded in a PDF the user analyzes, (2) man-in-the-middle interception of the plugin's API requests, or (3) a malicious/attacker-controlled custom LLM endpoint the user has configured. The vulnerable code path is the unsanitized pass of LLM response text into window.eval() in views.ts in versions ≤0.6.1. Limiting factors: no exploitation without user interaction with the plugin; the MITM vector needs network positioning and typically defeats TLS to succeed; the custom-endpoint vector needs the user to have set a non-default, untrusted endpoint; the PDF-injection vector is the most practical since it works against the default configuration once the user runs an LLM query on a malicious document.

This is a genuine high-priority issue rather than a high-CVSS-but-low-impact one: the CVSS 4.0 base is 9.4 with AV:N/AC:L/PR:N and high impact across confidentiality, integrity, and availability of both the vulnerable and subsequent systems, and the outcome is code execution in a privileged desktop context. The one moderating factor is UI:A - a victim must actually use the plugin against attacker-influenced content, so it is not wormable or unauthenticated-drive-by; the most realistic path (prompt injection via a downloaded PDF) is low-complexity, while the MITM path requires network positioning and the malicious-endpoint path requires the user to configure a hostile endpoint. No EPSS score, KEV entry, or public PoC is provided, so probability-of-exploitation telemetry is absent; the risk case rests on the confirmed source-code sink and the ease of the PDF-injection vector, and even a mid-sized municipal research or IT team in gliwice running Zotero with this plugin should treat patching as urgent given how routinely academics open untrusted PDFs. Note the mismatch worth verifying: CVSS marks AV:N/PR:N, but exploitation effectively depends on the victim's own use of the plugin and, for two of three vectors, on non-default trust conditions (attacker-controlled endpoint or MITM position).

An attacker seeds a research PDF with hidden prompt-injection text that instructs the LLM to return a JavaScript payload; when a victim opens the document in Zotero and asks PapersGPT to summarize or query it, the returned text is passed to window.eval() and executes in Zotero's chrome context, letting the attacker read/write files and spawn processes. Alternatively, an attacker on the network path (MITM) or one who has convinced the user to configure a malicious custom LLM endpoint can return the same payload directly. No public PoC is identified, but the source diff confirms the exact vulnerable sink.