PapersGPT for Zotero — RCE via unsanitized LLM output passed to window.eval()

NVD/CVE.org published CVE-2026-73032 (CVSS 9.6, Critical); confirmed via CVE Record and secondary technical writeup describing the window.eval() flaw in views.ts.

This is a direct, real-world prompt-injection-to-RCE attack path: content controlled entirely by an untrusted document (a PDF) can achieve code execution in a privileged desktop application context via the LLM plugin's insecure output handling — exactly the 'demonstrated real-world attack path' pattern called out as high-value AI-relevant risk.

The plugin passes LLM-generated content directly to window.eval() in views.ts without sanitization. An attacker can trigger arbitrary JavaScript execution in Zotero's chrome-privileged context via prompt injection embedded in a PDF the user opens, a MITM-tampered API response, or a malicious custom LLM endpoint configured by the victim.

PapersGPT for Zotero <= 0.6.1

Update to a patched PapersGPT release when available; avoid configuring untrusted custom LLM endpoints; disable eval-based rendering.