CVE-2026-42079CWE-95

PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope

High · published May 4, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00212 · 10.9th percentile
Weakness
CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2026-05-04T16:57Z
EPSS history
Timeline
  • 04 MAY 16:57Z
    PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope
    cvelistv5