CVE-2026-42079

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-42079

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42079.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-42079

Aliases

Published

2026-05-04T16:57:09.422Z

Modified

2026-07-15T01:49:22.316897663Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope

Details

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a.

Database specific

{
    "cwe_ids": [
        "CWE-95"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42079.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "418491a9a1c02d9d93194b5973bb58df35cf9d00"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/icip-cas/pptagent

Affected ranges

Type

GIT

Repo

https://github.com/icip-cas/pptagent

Events

Introduced

Fixed

418491a9a1c02d9d93194b5973bb58df35cf9d00

Database specific

{
    "source": "REFERENCES"
}

Affected versions

v1.*

v1.1.33

v1.1.34

v1.1.35

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42079.json"