This, but at least in my Debian oldstable based distro, it requires Poppler, which the currently highest sibling of your post has pointed out has had vulnerabilities at least in the distant past (Edit: ~7+ years ago). (Edit the second: upstream also supports mupdf https://pwmt.org/projects/zathura/plugins/, but that’s had exploits as recently as 2017 on https://www.exploit-db.com/.)