PapersGPT for Zotero 0.6.1 Vulnerability: Critical Remote Code Execution
- Severity
- CRITICAL
- CVSS
- 9.6
- Affected component
- papersgpt-for-zotero (npm)
- Affected versions
- >= papersgpt-v0.6.1, <= papersgpt-v0.6.1 or >= papersgpt-v0.6.0, <= papersgpt-v0.6.0 or >= papersgpt-v0.5.5, <= papersgpt-v0.5.5 or >= papersgpt-v0.5.4, <= papersgpt-v0.5.4 or >= papersgpt-v0.5.3, <= papersgpt-v0.5.3 or >= papersgpt-v0.5.2, <= papersgpt-v0.5.2 or >= papersgpt-v0.5.1, <= papersgpt-v0.5.1 or >= papersgpt-v0.5.0, <= papersgpt-v0.5.0 or >= papersgpt-v0.4.9, <= papersgpt-v0.4.9 or >= papersgpt-v0.4.8, <= papersgpt-v0.4.8 or >= papersgpt-v0.4.7, <= papersgpt-v0.4.7 or >= papersgpt-v0.4.6, <= papersgpt-v0.4.6 or >= papersgpt-v0.4.5, <= papersgpt-v0.4.5 or >= papersgpt-v0.4.4, <= papersgpt-v0.4.4 or >= papersgpt-v0.4.3, <= papersgpt-v0.4.3 or >= papersgpt-v0.4.2, <= papersgpt-v0.4.2 or >= papersgpt-v0.4.1, <= papersgpt-v0.4.1 or >= papersgpt-v0.4.0, <= papersgpt-v0.4.0 or >= papersgpt-v0.3.9, <= papersgpt-v0.3.9 or >= papersgpt-v0.3.8, <= papersgpt-v0.3.8 or >= papersgpt-v0.3.7, <= papersgpt-v0.3.7 or >= papersgpt-v0.3.6, <= papersgpt-v0.3.6 or >= papersgpt-v0.3.5, <= papersgpt-v0.3.5 or >= papersgpt-v0.3.4, <= papersgpt-v0.3.4 or >= papersgpt-v0.3.3, <= papersgpt-v0.3.3 or >= papersgpt-v0.3.2, <= papersgpt-v0.3.2 or >= papersgpt-v0.3.1, <= papersgpt-v0.3.1 or >= papersgpt-v0.3.0, <= papersgpt-v0.3.0 or >= papersgpt-v0.2.5, <= papersgpt-v0.2.5 or >= papersgpt-v0.2.4, <= papersgpt-v0.2.4 or >= papersgpt-v0.2.3, <= papersgpt-v0.2.3 or >= papersgpt-v0.2.2, <= papersgpt-v0.2.2 or >= papersgpt-v0.2.1, <= papersgpt-v0.2.1 or >= papersgpt-v0.2.0, <= papersgpt-v0.2.0 or >= papersgpt-v0.1.3, <= papersgpt-v0.1.3 or >= papersgpt-v0.1.2, <= papersgpt-v0.1.2 or >= papersgpt-v0.1.1, <= papersgpt-v0.1.1 or >= papersgpt-v0.1.0, <= papersgpt-v0.1.0 or >= papersgpt-v0.0.20, <= papersgpt-v0.0.20 or >= papersgpt-v0.0.19, <= papersgpt-v0.0.19 or >= papersgpt-v0.0.18, <= papersgpt-v0.0.18 or >= papersgpt-v0.0.17, <= papersgpt-v0.0.17 or >= papersgpt-v0.0.16, <= papersgpt-v0.0.16 or >= papersgpt-v0.0.15, <= papersgpt-v0.0.15 or >= papersgpt-v0.0.14, <= papersgpt-v0.0.14 or >= papersgpt-v0.0.12, <= papersgpt-v0.0.12 or >= papersgpt-v0.0.11, <= papersgpt-v0.0.11 or >= papersgpt-v0.0.10, <= papersgpt-v0.0.10 or >= papersgpt-v0.0.9, <= papersgpt-v0.0.9 or >= papersgpt-v0.0.8, <= papersgpt-v0.0.8 or >= papersgpt-v0.0.7, <= papersgpt-v0.0.7 or >= papersgpt-v0.0.6, <= papersgpt-v0.0.6 or >= papersgpt-v0.0.5, <= papersgpt-v0.0.5 or >= papersgpt-v0.0.4, <= papersgpt-v0.0.4 or >= papersgpt-v0.0.3, <= papersgpt-v0.0.3 or >= papersgpt-v0.0.2, <= papersgpt-v0.0.2 or >= papersgpt-v0.0.1, <= papersgpt-v0.0.1
- Patched version
- Not yet available
PapersGPT for Zotero version 0.6.1 reportedly contains a critical remote code execution vulnerability that allows arbitrary JavaScript execution. Users of this version are potentially affected.
What happened
An early warning has been issued for a critical vulnerability in PapersGPT for Zotero version 0.6.1. This vulnerability allows remote code execution through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint. The vulnerability is tracked as CVE-2026-73032 with a CVSS score of 9.6. The issue was first flagged on 2026-08-11.
The vulnerability affects all versions of papersgpt-for-zotero from 0.0.1 to 0.6.1 inclusive. Users of any version within this range should assess their exposure and take immediate action to mitigate the risk.
What to do about it
- Monitor the official sources for updates on a patched version of papersgpt-for-zotero.
- Review your Zotero data for any signs of compromise.
- Avoid using papersgpt-for-zotero until a patched version is available and verified.
- Consider disabling the plugin in Zotero until the vulnerability is addressed.
- Stay informed by consulting the primary sources for the latest information on this vulnerability.
How 0Day would have caught this
papersgpt-for-zotero is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using any version of papersgpt-for-zotero from 0.0.1 to 0.6.1 inclusive.
What should I do right now?
Monitor the official sources for updates on a patched version. Review your Zotero data for signs of compromise. Consider disabling the plugin until the vulnerability is addressed.
Is there a patched version available?
No official fix has been published yet. Monitor the sources for updates.
How can attackers exploit this vulnerability?
Attackers can exploit this vulnerability through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint.