p PatchFirst

CVE-2026-42079

CVE-2026-42079 · PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a.

CVSS 8.6 · High · EPSS 0.1% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • pptagent

    Versions
    • < 418491a9a1c02d9d93194b5973bb58df35cf9d00: Affected

    No fix published

  • pptagent PyPI

    Versions
    • 0.2.0
    • 0.2.1
    • 0.2.10
    • 0.2.11
    • 0.2.13
    • 0.2.14
    • 0.2.15
    • 0.2.16
    • 0.2.17
    • 0.2.18
    • 0.2.2
    • 0.2.3
    • 0.2.4
    • 0.2.5
    • 0.2.6
    • 0.2.7
    • 0.2.8
    • 0.2.9
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 1.1.1
    • 1.1.10
    • 1.1.11
    • 1.1.12
    • 1.1.13
    • 1.1.14
    • 1.1.15
    • 1.1.16
    • 1.1.17
    • 1.1.18
    • 1.1.19
    • 1.1.2
    • 1.1.20
    • 1.1.21
    • 1.1.22
    • 1.1.24
    • 1.1.26
    • 1.1.27
    • 1.1.28
    • 1.1.29
    • 1.1.3
    • 1.1.30
    • 1.1.31
    • 1.1.32
    • 1.1.33
    • 1.1.34
    • 1.1.35
    • 1.1.5
    • 1.1.6
    • 1.1.7
    • 1.1.8
    • 1.1.9
    Affected ranges
    • ECOSYSTEM: < 1.1.36

    Update to 1.1.36

Original sources

Check your server →