CVE-2026-73032: PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary Jav

PapersGPT for Zotero 0.6.1 has a remote code execution vulnerability (RCE, where attackers can run commands on a system they don't own) that lets attackers execute malicious JavaScript code by tricking the AI into returning harmful instructions through prompt injection (hiding malicious commands in AI inputs), intercepting network traffic, or using a fake AI endpoint. This gives attackers dangerous abilities like reading and writing files, running programs, and stealing all data in Zotero (a research management tool).