CVE-2026-42079
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
PPTAgent is a framework for generating PowerPoint presentations. Prior to commit 418491a, PPTAgent was vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope.
Risk Assessment
Exploitation of this vulnerability could lead to the execution of malicious code within the application context, posing a serious security threat.
Recommendation
It is recommended to update to the version containing commit 418491a to mitigate this vulnerability.
Other vulnerabilities in PPTAgent
See all- CVE-2026-42080Medium
PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, there is an arbitrary file write vulnerability via `save_generated_slides`. This issue has been patched via commit 418491a.
- CVE-2026-42078Medium
PPTAgent, a framework for reflective PowerPoint generation, is vulnerable to arbitrary file write and directory creation via markdown_table_to_image. The issue has been patched in commit 418491a.
Original NVD description (English source)
PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS