Description

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero's chrome-privileged context, enabling file read/write, process execution, and access to all Zotero data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-11T20:18:46.320Z",
  "pubdate": "2026-08-11T20:18:46.320Z",
  "executiveSummary": "PapersGPT for Zotero version 0.6.1 suffers from a critical remote code execution vulnerability stemming from improper input sanitization. The flaw exists in the handling of responses received from Large Language Model endpoints within the extension's codebase. Specifically, untrusted data returned by an LLM endpoint is passed directly into a JavaScript evaluation sink.\nThe vulnerability allows remote attackers to achieve arbitrary code execution within Zotero's highly privileged chrome context. Because Zotero extensions execute with elevated privileges, successful exploitation compromises the entire application and host environment. Attackers can leverage this capability to read and write arbitrary files on the local filesystem, execute operating system processes, and compromise all stored Zotero data.\nExploitation vectors include indirect prompt injection embedded within malicious PDF documents processed by the extension, man-in-the-middle interception and tampering of API responses communicating with LLM endpoints, or the utilization of a malicious custom LLM endpoint controlled by the adversary. No specialized authentication or prior access to the local system is strictly required if the attack is successfully triggered via untrusted input or intercepted network communication.",
  "technicalDetails": "The root cause of the remote code execution vulnerability is the insecure processing of dynamic data originating from external LLM services. In the vulnerable version 0.6.1, responses retrieved from configured LLM endpoints are treated as trusted executable structures rather than plain text data.\nThe vulnerable component is identified as views.ts, where data received from the LLM integration is passed unsanitized directly into the window.eval() function. Because window.eval() evaluates arbitrary strings as executable JavaScript within the local execution context, any malicious payload injected into the LLM response stream is executed immediately by the application.\nAttackers can deliver the payload through multiple distinct attack flows. In the first vector, an adversary embeds a crafted prompt injection payload inside a PDF document. When the user utilizes PapersGPT to analyze or query the PDF, the malicious prompt instructs the LLM to output a specific JavaScript payload designed to exploit the window.eval() sink. In the second vector, an adversary positioned on the network performs a man-in-the-middle attack against API requests, intercepting valid communication with the LLM endpoint and replacing the legitimate response body with malicious JavaScript code. In the third vector, an attacker induces the user to configure or connect to a malicious custom LLM endpoint, which directly returns the exploit payload upon interaction.\nUpon successful execution of the injected payload via window.eval(), the code inherits Zotero's chrome-privileged context. This elevated security context completely bypasses standard browser sandbox restrictions. Consequently, the post-exploitation impact is severe, granting the adversary unrestricted capabilities to read and write arbitrary files, execute native operating system commands via privileged APIs, and exfiltrate or manipulate all sensitive data stored within the Zotero database."
}