CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-73032 — PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that a...

·Source: NIST NVD

Updated:

Executive Summary

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero

Analysis

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero's chrome-privileged context, enabling file read/write, process execution, and access to all Zotero data. CVSS Score: 9.6. Published: 2026-08-11T20:18:46.320.

Indicators of Compromise (1)

CVE (1)
CVE-2026-73032
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 11, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Stablecoins offer little cost or speed advantage for remittances - Banca d'Italia

Stablecoins show no systematic cost advantage over traditional remittance channels for cross-border payments, researchers at Banca d'Italia have found.

Finextra
MEDIUMVulnerabilityNEW

Mobile wallets gain traction in the UK

Cards continue to dominate UK payments but mobile wallets are increasingly popular, with nearly two thirds of the population registered with at least one provider, according to the latest industry data.

Finextra
MEDIUMVulnerabilityNEW

CISA Weighs Outsourcing Its Cyber Software Buying

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cisa-weighs-outsourcing-its-cyber-software-buying-image_small-9-a-32595.jpg" align=right hspace=4><b>CISA Issues Sources Sought Notice Floating $600M a Year, $6B Over Contract Life</b><br>The U.S. Cybersecurity and Infrastructure Security Agency is surveying industry on whether a contractor could take over cybersecurity software b

Bank Info Security