PapersGPT for Zotero Prompt-Injection-to-RCE via window.eval()

Technical Analysis

The plugin's views.ts takes text returned from an LLM endpoint and evaluates it directly with window.eval() without any output validation or sandboxing, so any code embedded in the model's response executes with the same privileges as the Zotero application (chrome-privileged context). The entry point spans three vectors: a poisoned PDF containing hidden instructions that cause the LLM to emit malicious JavaScript, a MITM attacker tampering with the HTTP response from the LLM API, or a user-configured malicious/compromised custom LLM endpoint that deliberately returns exploit code. This crosses the boundary from 'untrusted model output' to 'trusted local execution environment' with no intermediate sanitization, giving the attacker file system access, arbitrary process execution, and full access to the user's Zotero library and credentials. Because Zotero plugins run with broad local privileges, this effectively turns any successful prompt injection into a full RCE primitive.

Affected Systems

PapersGPT for Zotero

Detection Signatures

• Outbound LLM API responses containing script-like syntax (e.g., function calls, DOM/XPCOM object references) unexpectedly embedded in summarization or chat output
• PDF documents containing suspicious embedded text blocks resembling instructions to an AI/LLM (e.g., 'ignore previous instructions', encoded scripts, unusual invisible/white text)
• Network traffic to LLM endpoints without TLS certificate pinning or with unexpected certificate changes (possible MITM)
• Zotero process spawning unexpected child processes or performing unexpected file I/O after PDF import or AI-assisted actions
• Use of window.eval() or similar dynamic evaluation on any string sourced from network/LLM responses in plugin code

Remediation Steps

1. 1

   Remove eval() on LLM output

   Refactor views.ts to never pass LLM-returned strings to window.eval() or any dynamic code execution function; parse expected structured output (e.g., JSON) with strict schema validation instead.

2. 2

   Sandbox rendering of AI content

   Render LLM output as plain text or sanitized HTML in a restricted, non-privileged context (not chrome-privileged), using allow-listed formatting only.

3. 3

   Enforce TLS integrity for LLM API calls

   Require certificate validation/pinning for requests to LLM endpoints to prevent MITM tampering with responses.

4. 4

   Treat PDF content as untrusted input

   Sanitize or isolate text extracted from PDFs before sending to the LLM, and treat any instructions embedded in document text as non-authoritative, never executable.

5. 5

   Restrict custom endpoint trust

   Warn users clearly when configuring custom/self-hosted LLM endpoints and limit the plugin's execution privileges regardless of endpoint source.

6. 6

   Patch and update

   Upgrade PapersGPT for Zotero to a patched version once released; until then, disable the plugin or restrict it from processing untrusted PDFs.