CVE-2026-73032 is a critical (CVSS 9.6) code injection flaw in PapersGPT for Zotero 0.6.1. Text returned by a language model endpoint is passed unsanitized to window.eval, so hostile output can run code inside Zotero. Check the project releases for a build that removes the eval.
What's affected
The record names PapersGPT for Zotero version 0.6.1. It does not list a fixed version. The project's pull request 155 is titled as removing the window.eval of the model response in the execTag function, and the record links the matching commit, but I could not confirm which release carries it. Check the repository's releases page.
The code runs in Zotero's privileged context, which the record says allows file reads and writes, process execution and access to all Zotero data.
How to check if you're exposed
In Zotero, open Tools, then Add-ons, and read the version of PapersGPT. If it is 0.6.1, you are in scope. Then check the project's releases page for a newer version that mentions the eval change.
Also review which model endpoint the add-on talks to. A custom endpoint you do not control is part of the risk, as is any plain HTTP connection.
What to do now
- Check the version of PapersGPT installed in each Zotero profile.
- Update to a release that includes the fix once you can confirm one.
- Until then, disable the add-on, or use it only with an endpoint you trust over HTTPS.
- Avoid running it on PDFs from untrusted sources.
- Back up your Zotero library before updating or removing the add-on.
Why it matters
The record maps this to CWE-94, code injection. The add-on takes whatever the model returns and evaluates it as script. A model is not a trusted component. What it returns depends on its input, and the record notes that a document the user opens can carry instructions aimed at the model, which is a form of prompt injection.
Two more routes appear in the record: an attacker who can alter the network traffic between the add-on and the model, and a malicious custom endpoint. In each case the add-on turns text into code without asking.
The record's KEV flag is false and it does not claim exploitation. The rule worth carrying away: never pass model output to eval, and treat it like any other untrusted input.
Quick check
Is there a fixed release of PapersGPT for Zotero?
I could not confirm one. The linked pull request removes the eval, so check the releases page for a version that includes it.
Sources
Last reviewed: 19 October 2026.
