External risk intelligence

PapersGPT for Zotero RCE via Unsanitized LLM Response

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-73032

This vulnerability exists in a Zotero plugin, which is client-side software used on local workstations for research management. It is not a network-exposed service, gateway, or public-facing application, and it operates within the context of a local user's desktop environment.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the PapersGPT for Zotero plugin allows for remote code execution by exploiting how it processes responses from large language model endpoints. This could enable attackers to execute arbitrary code within Zotero's privileged context, potentially leading to unauthorized access and manipulation of user data. The main concern is confirming relevance and exposure as the plugin operates on local workstations.

Plugin flaws allow malicious code execution.
Understand its potential impact on user data.
Confirm if this plugin is in use.

Attack Path

How an attacker could exploit the issue

An attacker could initiate a code execution attack by tricking a user into processing a malicious PDF, intercepting API requests, or configuring a rogue LLM endpoint. This would lead to the execution of arbitrary JavaScript within the Zotero application's trusted environment, potentially allowing the attacker to access or modify user files and data.

Requires user interaction.
Triggered by processing crafted input.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary code within Zotero's privileged context, potentially leading to unauthorized access to local files, execution of commands on the user's system, and compromise of all data stored within Zotero. This could occur when a user interacts with a specially crafted PDF or a malicious LLM endpoint.

Zotero data and local files.
Malicious input to LLM or PDFs.
Arbitrary code execution and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PapersGPT for Zotero plugin's remote code execution vulnerability likely impacts individual users and IT support teams responsible for managing user workstations. The immediate priority is to identify all Zotero installations that utilize the affected plugin, confirm if these instances are exposed to potentially malicious input, and then coordinate with affected users or application owners for remediation.

Identify affected Zotero installations.
Verify potential exposure to malicious input.
Plan user-level remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PapersGPT for Zotero?

PapersGPT for Zotero is a third-party plugin designed for Zotero, a popular open-source tool used by researchers and academics to collect, organize, and cite bibliographic data. The plugin integrates large language model (LLM) capabilities directly into the Zotero interface, allowing users to interact with and summarize documents. It functions as a local extension within the Zotero desktop application, effectively adding external AI-driven features to the research management workflow.

What is the vulnerability in CVE-2026-73032?

This CVE describes a Code Injection weakness (CWE-94). The plugin takes responses from an LLM service and passes them directly to a function called window.eval(). Because the plugin does not sanitize or validate this input first, an attacker can provide malicious JavaScript instead of a normal text response. When the plugin processes this, it executes the attacker's code inside the Zotero environment, granting the code the same high-level permissions the application itself possesses.

How can an attacker trigger this RCE flaw?

An attacker triggers this by ensuring the plugin receives malicious code from an LLM endpoint. This can happen through prompt injection within a PDF file, intercepting and modifying the plugin's network requests, or directing the plugin to a rogue LLM server controlled by the attacker. Simply using the plugin for normal, trusted research does not trigger the bug; it requires the processing of specifically crafted, adversarial input designed to be executed as code.

Is my Zotero installation at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a client-side risk rather than a network-exposed service. Because the plugin runs on a local workstation, it is not an internet-facing gateway or server application. The vulnerability is highly unlikely to be exploited remotely across the internet in the traditional sense; instead, it requires the user to interact with malicious content or endpoints while using the plugin on their personal or work computer.

What should I do if I use PapersGPT for Zotero?

If you use this plugin, your first step is to verify whether you have the affected version installed. Since this vulnerability grants the plugin's code significant access to your local files and Zotero data, you should immediately check the project's official repository for updates or security patches. If no secure version is currently available, consider disabling or uninstalling the plugin from your Zotero environment to prevent potential execution of unauthorized code.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.