EUVD-2026-56896
GHSA-27wm-9rgh-2vcq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote attacker-controlled LLM text executes with no privileges but requires the victim to run a query (UI:R); eval in chrome context breaks out of the plugin (S:C) yielding full C/I/A impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero's chrome-privileged context, enabling file read/write, process execution, and access to all Zotero data.
AnalysisAI
Arbitrary code execution in the PapersGPT for Zotero plugin (versions ≤0.6.1) lets an attacker who controls or tampers with LLM responses run JavaScript in Zotero's chrome-privileged context. Text returned from the LLM endpoint is passed unsanitized into window.eval() in views.ts, so a poisoned PDF (prompt injection), a man-in-the-middle on the API channel, or a malicious custom endpoint can achieve full RCE. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim actually invoke PapersGPT's LLM interaction (UI:A) on attacker-influenced input, and that the attacker control the text returned by the LLM endpoint via one of three named vectors: (1) prompt injection embedded in a PDF the user analyzes, (2) man-in-the-middle interception of the plugin's API requests, or (3) a malicious/attacker-controlled custom LLM endpoint the user has configured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than a high-CVSS-but-low-impact one: the CVSS 4.0 base is 9.4 with AV:N/AC:L/PR:N and high impact across confidentiality, integrity, and availability of both the vulnerable and subsequent systems, and the outcome is code execution in a privileged desktop context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker seeds a research PDF with hidden prompt-injection text that instructs the LLM to return a JavaScript payload; when a victim opens the document in Zotero and asks PapersGPT to summarize or query it, the returned text is passed to window.eval() and executes in Zotero's chrome context, letting the attacker read/write files and spawn processes. Alternatively, an attacker on the network path (MITM) or one who has convinced the user to configure a malicious custom LLM endpoint can return the same payload directly. … |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - the input provides commit 094134172ce4a344a31e4b196cc75d1806383658 and pull request https://github.com/papersgpt/papersgpt-for-zotero/pull/155, which remove the window.eval() execution path and the eval-based RegExp in views.ts, but no tagged release version is given, so verify the fixed release on the project's GitHub releases page before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all organizational deployments of PapersGPT for Zotero version 0.6.1 or earlier and assess the criticality of this plugin to research operations and business continuity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today