PT-2026-36857 · Pptagent · Pptagent

Koukyosyumei · Published 2026-05-04 · Updated 2026-05-06 · CVE-2026-42079

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PPTAgent versions prior to commit 418491a

Description An agentic framework for reflective PowerPoint generation allows arbitrary code execution. This occurs because the software uses the Python eval() function to process code generated by a Large Language Model (LLM) while builtins are in scope.

Recommendations Update to the version containing commit 418491a.

Exploit

Fix

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-42079

GHSA-89G2-XW5C-V95P

Affected Products

Pptagent

References · 9

• 🔥 https://github.com/icip-cas/PPTAgent/security/advisories/GHSA-89g2-xw5c-v95p · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42079 · Security Note
• https://osv.dev/vulnerability/GHSA-89g2-xw5c-v95p · Vendor Advisory
• https://github.com/icip-cas/PPTAgent · Note
• https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00 · Note
• https://t.me/CVEtracker/52635 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2051436933373379017 · Twitter Post
• https://reddit.com/r/LaAutopsIA/comments/1t5gb6b/pptagent_vulnerabilidad_cr%C3%ADtica_permite_ejecuci%C3%B3n · Reddit Post
• https://twitter.com/CVEnew/status/2051361270515880136 · Twitter Post