CVE-2026-42079 HIGH

CVE-2026-42079: PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope

Vendor Icip-Cas
Product PPTAgent
Weakness CWE-95 · Eval injection
Published May 4, 2026
Last update May 4, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

Description

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a.

Key dates

Disclosure timeline

May 4, 2026 CVE published
May 4, 2026 Record updated