PPTAgent — Rce (CVE-2026-42079)
Date: 2026-05
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-42078
CVE-2026-42079
CVE-2026-42080
CWE: CWE-22
CWE-95
CVSS: 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a.


Mitigations:

Architectural layers (MAESTRO):