6 matches found
EUVD-2026-56896
PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM...
CVE-2026-73032
PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability: an unsanitized LLM response passed to window.eval() in views.ts allows arbitrary JavaScript execution in Zotero's chrome-privileged context. Attackers can exploit prompt injection in PDFs, MITM interception of API requests...
CVE-2026-73032
PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM...
CVE-2026-73032 PapersGPT for Zotero 0.6.1 RCE via Unsanitized LLM Response eval()
PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM...
@cenk1cenk2/renovate-config (>=2.3.132 <=2.3.148), @jamietanna/patch-testing (>=0.1.0 <=0.2.28) +7 more potentially affected by unknown CVE via renovate (>=36.109.4 <=40.21.2)
renovate NPM version =36.109.4, =2.3.132, =0.1.0, =0.14.0, =0.5.0, =0.1.0, =0.1.0, =0.0.1, =0.19.0 - @zotero-chinese/renovate-config =1.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-FR4J-65PV-GJJJ...
zotero.org XSS vulnerability
Open Bug Bounty ID: OBB-668780 Description| Value ---|--- Affected Website:| zotero.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...