CVE-2026-42079 Details
Description
PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a.
A vulnerability allowing arbitrary code execution has been identified in PPTAgent, an agentic framework for reflective PowerPoint generation. This issue affects versions prior to commit 418491a, where the application improperly handled LLM-generated code by passing it to Python's eval() function with builtins accessible. The vulnerability arises in the 'execute_actions' method of the 'apis.py' file, where user-influenced slide editing commands can be executed as arbitrary code. The flaw has been patched in version 1.1.37.
Users can update to PPTAgent version 1.1.37 or later, where this vulnerability has been fixed. The patch involves modifying the 'execute_actions' method to use a safe evaluation context that excludes access to built-in functions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 4, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/icip-cas/PPTAgent/security/advisories/GHSA-89g2-xw5c-v95p | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00 | [email protected] | Source CodeVendor |
| https://github.com/icip-cas/PPTAgent/security/advisories/GHSA-89g2-xw5c-v95p | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| icip-cas PPTAgent | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | New CVE Received | [email protected] |