Affected: icip-cas PPTAgent

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a.

Affected: PyPI: pptagent

## Summary

> This vulnerability has been fixed in https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00.

`CodeExecutor.execute_actions` (pptagent/apis.py:126-205) processes LLM-generated slide editing actions using Python's `eval()`:

```python # pptagent/apis.py:184-186 partial_func = partial(self.registered_functions[func], edit_slide) if func == "replace_image": partial_func = partial(partial_func, doc) eval(line, {}, {func: partial_func}) # ← builtins accessible ```

The call `eval(line, {}, {func: partial_func})` passes an empty dict as globals. Per Python's language reference: "If the globals dictionary is present and does not contain a value for the key `__builtins__`, a reference to the dictionary of the built-in module builtins is inserted under that key before the expression is parsed." **This means `__import__`, open, exec, compile, and all other built-in functions are available inside the evaluated expression**.

The validation before eval only checks 1) The function name matches ^[a-z]+_[a-z_]+ (snake_case pattern) and 2) The function name is in self.registered_functions.

The arguments to the function are not validated. If an attacker can influence the LLM's generated edit actions (via prompt injection through slide content, document content, or the command_list context), the following payload would execute arbitrary code:

```python # Attacker-controlled slide content feeds into the command_list context # The…