https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:16:04 +0000 https://cve.radiocsirt.org/vuln/cve-2026-42079 <p><strong>Affected:</strong> icip-cas PPTAgent</p> <p>PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a.</p> <p><strong>Affected:</strong> icip-cas PPTAgent</p> <p>PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a.</p> https://cve.radiocsirt.org/vuln/cve-2026-42079 https://cve.radiocsirt.org/vuln/ghsa-89g2-xw5c-v95p <p><strong>Affected:</strong> PyPI: pptagent</p> <p>## Summary</p> <p>&gt; This vulnerability has been fixed in https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00.</p> <p>`CodeExecutor.execute_actions` (pptagent/apis.py:126-205) processes LLM-generated slide editing actions using Python&#39;s `eval()`:</p> <p>```python # pptagent/apis.py:184-186 partial_func = partial(self.registered_functions[func], edit_slide) if func == &#34;replace_image&#34;: partial_func = partial(partial_func, doc) eval(line, {}, {func: partial_func}) # ← builtins accessible ```</p> <p>The call `eval(line, {}, {func: partial_func})` passes an empty dict as globals. Per Python&#39;s language reference: &#34;If the globals dictionary is present and does not contain a value for the key `__builtins__`, a reference to the dictionary of the built-in module builtins is inserted under that key before the expression is parsed.&#34; **This means `__import__`, open, exec, compile, and all other built-in functions are available inside the evaluated expression**.</p> <p>The validation before eval only checks 1) The function name matches ^[a-z]+_[a-z_]+ (snake_case pattern) and 2) The function name is in self.registered_functions.</p> <p>The arguments to the function are not validated. If an attacker can influence the LLM&#39;s generated edit actions (via prompt injection through slide content, document content, or the command_list context), the following payload would execute arbitrary code:</p> <p>```python # Attacker-controlled slide content feeds into the command_list context # The…</p> <p><strong>Affected:</strong> PyPI: pptagent</p> <p>## Summary</p> <p>&gt; This vulnerability has been fixed in https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00.</p> <p>`CodeExecutor.execute_actions` (pptagent/apis.py:126-205) processes LLM-generated slide editing actions using Python&#39;s `eval()`:</p> <p>```python # pptagent/apis.py:184-186 partial_func = partial(self.registered_functions[func], edit_slide) if func == &#34;replace_image&#34;: partial_func = partial(partial_func, doc) eval(line, {}, {func: partial_func}) # ← builtins accessible ```</p> <p>The call `eval(line, {}, {func: partial_func})` passes an empty dict as globals. Per Python&#39;s language reference: &#34;If the globals dictionary is present and does not contain a value for the key `__builtins__`, a reference to the dictionary of the built-in module builtins is inserted under that key before the expression is parsed.&#34; **This means `__import__`, open, exec, compile, and all other built-in functions are available inside the evaluated expression**.</p> <p>The validation before eval only checks 1) The function name matches ^[a-z]+_[a-z_]+ (snake_case pattern) and 2) The function name is in self.registered_functions.</p> <p>The arguments to the function are not validated. If an attacker can influence the LLM&#39;s generated edit actions (via prompt injection through slide content, document content, or the command_list context), the following payload would execute arbitrary code:</p> <p>```python # Attacker-controlled slide content feeds into the command_list context # The…</p> https://cve.radiocsirt.org/vuln/ghsa-89g2-xw5c-v95p