CVE-2026-42080
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, there is an arbitrary file write vulnerability via `save_generated_slides`. This issue has been patched via commit 418491a.
Risk Assessment
An attacker could write arbitrary files to the system, potentially leading to code execution or data integrity compromise. However, this requires access to the slide generation functionality.
Recommendation
Update PPTAgent to commit 418491a or later. Check for any unauthorized files written by the application.
Other vulnerabilities in PPTAgent
See all- CVE-2026-42079High
PPTAgent is a framework for generating PowerPoint presentations. Prior to commit 418491a, PPTAgent was vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope.
- CVE-2026-42078Medium
PPTAgent, a framework for reflective PowerPoint generation, is vulnerable to arbitrary file write and directory creation via markdown_table_to_image. The issue has been patched in commit 418491a.
Original NVD description (English source)
PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, there is an arbitrary file write vulnerability via `save_generated_slides`. This issue has been patched via commit 418491a.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS