CVE-2026-42079
Arbitrary Code Execution in PPTAgent via Python eval()
Publication date: 2026-05-04
Last updated on: 2026-05-04
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-95 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in PPTAgent involves arbitrary code execution caused by the use of Python's eval() function on code generated by a large language model (LLM). Before a specific patch (commit 418491a), the eval() function was called with builtins in scope, allowing maliciously crafted code to execute arbitrary commands.
How can this vulnerability impact me? :
This vulnerability can lead to an attacker executing arbitrary code on the system running PPTAgent. This can result in complete compromise of confidentiality, integrity, and availability of the affected system.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in PPTAgent has been patched via commit 418491a. To mitigate this vulnerability, you should update PPTAgent to a version that includes this commit.