CVE-2026-73032 is the cleanest "PDF becomes RCE" chain I've read all year. PapersGPT for Zotero 0.6.1, the plugin that lets you chat with your PDFs, takes the LLM endpoint output and drops it straight into window.eval() in views.ts. No sanitizing. NVD scored it CVSS 3.1 9.6 / CVSS 4.0 9.4, critical, published Aug 11 2026. I dug into why this is so bad, and it's the context that eval runs in. Zotero runs on chrome-privileged code. So eval() there isn't sandboxed browser JS. It's full file read/write, process execution, and access to every bit of Zotero data you have. That's remote code execution (RCE), not a popup. Now the fun part: three ways to feed it JavaScript. 1. Plant a prompt injection inside a PDF. You open a paper, ask "summarize this," the model returns JS, it runs. 2. MITM the API call and rewrite the response. 3. Point it at a malicious custom LLM endpoint that just returns code. One idea I keep repeating: the model is only the courier. The real bug is downstream, in the code that trusts the courier. Here's the whole vulnerability in two lines. BEFORE (dangerous): // views.ts window.eval(llmResponse) // model output executed as code AFTER (safe): const data = JSON.parse(llmResponse) // model output is DATA, not code // validate data against a schema, then render. never eval. Building a doc-chat feature? Picture a law firm's contract review bot that reads client PDFs and answers questions. If any model output touches eval, exec, a shell, or a SQL string, a single poisoned PDF from opposing counsel owns the box. Treat every token the model returns as hostile user input. Because with prompt injection, that's exactly what it is. Quick check for your own stack: does any LLM response in your app reach eval(), a template renderer, os.system, or a raw query? Do you actually know, or do you just hope? #AISecurity #PromptInjection #LLM
Post summary
The text announces CVE‑2026‑73032, detailing a critical RCE via unsanitized LLM output in Zotero, and offers a defensive coding recommendation, but provides no PoC or active exploitation evidence.
