CVE-2026-73032 papersgpt CVE debrief

Who should care

Users of PapersGPT for Zotero 0.6.1, security teams, and IT administrators should assess exposure and prioritize remediation. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-73032 is a critical remote code execution vulnerability in PapersGPT for Zotero 0.6.1 that allows attackers to execute arbitrary JavaScript via malicious LLM endpoint responses. Users should assess exposure, prioritize remediation, and verify affected versions.

• Potential execution of arbitrary code in Zotero's chrome-privileged context
• Possible access to sensitive data and functionality
• Required verification of affected versions and systems
• Necessity of prompt remediation to prevent exploitation

Technical summary

The PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript via malicious LLM endpoint responses. The vulnerability is caused by unsanitized input to window.eval() in views.ts, enabling attackers to execute code in Zotero's chrome-privileged context. This could lead to potential execution of arbitrary code, access to sensitive data and functionality, and required verification of affected versions and systems. Users should assess exposure and prioritize remediation.

Defensive priority

High

Recommended defensive actions

• Assess exposure of PapersGPT for Zotero 0.6.1 in your environment
• Prioritize remediation of the remote code execution vulnerability
• Verify affected versions and systems
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the affected versions and remediation steps require verification from the official sources. The vulnerability has a CVSS score of 9.4 and is considered critical. Users should verify their systems and prioritize remediation to prevent potential exploitation. The official CVE Program record and NIST NVD detail page provide additional information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.