CVE-2026-42078
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
PPTAgent, a framework for reflective PowerPoint generation, is vulnerable to arbitrary file write and directory creation via markdown_table_to_image. The issue has been patched in commit 418491a.
Risk Assessment
Arbitrary file write and directory creation could allow overwriting critical files or placing malicious content. This may lead to remote code execution or system instability.
Recommendation
Update PPTAgent to commit 418491a or later. Restrict process permissions to the minimum necessary.
Other vulnerabilities in PPTAgent
See all- CVE-2026-42080Medium
PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, there is an arbitrary file write vulnerability via `save_generated_slides`. This issue has been patched via commit 418491a.
- CVE-2026-42079High
PPTAgent is a framework for generating PowerPoint presentations. Prior to commit 418491a, PPTAgent was vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope.
Original NVD description (English source)
PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary file write and directory creation via markdown_table_to_image. This issue has been patched via commit 418491a.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS