CVE-2026-42079

Published: May 4, 2026Modified: Jun 17, 2026Deferred

8.6

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a.

Related CWEs

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

References (3)

https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00

Source: security-advisories@github.com

https://github.com/icip-cas/PPTAgent/security/advisories/GHSA-89g2-xw5c-v95p

Source: security-advisories@github.com

https://github.com/icip-cas/PPTAgent/security/advisories/GHSA-89g2-xw5c-v95p

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.