PT-2026-36857 · Pptagent · Pptagent

Koukyosyumei · CVE-2026-42079 · Published 2026-05-04 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PPTAgent versions prior to commit 418491a

Description An agentic framework for reflective PowerPoint generation allows arbitrary code execution. This occurs because the software uses the Python eval() function to process code generated by a Large Language Model (LLM) while builtins are in scope.

Recommendations Update to the version containing commit 418491a.

Exploit

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-42079

GHSA-89G2-XW5C-V95P

PYSEC-2026-2892

Affected Products

Pptagent

References · 14

• 🔥 https://github.com/icip-cas/PPTAgent/security/advisories/GHSA-89g2-xw5c-v95p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42079.json · Exploit
• https://osv.dev/vulnerability/PYSEC-2026-2892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42079 · Security Note
• https://osv.dev/vulnerability/GHSA-89g2-xw5c-v95p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42079 · Vendor Advisory
• https://github.com/icip-cas/PPTAgent · Note
• https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00 · Note
• https://twitter.com/VulmonFeeds/status/2051436933373379017 · Twitter Post
• https://reddit.com/r/LaAutopsIA/comments/1t5gb6b/pptagent_vulnerabilidad_cr%C3%ADtica_permite_ejecuci%C3%B3n · Reddit Post
• https://t.me/CVEtracker/52635 · Telegram Post
• https://twitter.com/CVEnew/status/2051361270515880136 · Twitter Post
• https://github.com/advisories/GHSA-89g2-xw5c-v95p · Note
• https://pypi.org/project/pptagent · Note