EUVD-2026-27015
GHSA-89g2-xw5c-v95p
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionGitHub Advisory
PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a.
AnalysisAI
Arbitrary code execution in PPTAgent allows local attackers to execute Python code by exploiting unsafe eval() of LLM-generated content with unrestricted builtins. The framework's agentic architecture passes AI-generated code directly to eval() with full builtin access, enabling execution of arbitrary system commands. Patch available via commit 418491a which restricts eval() globals to an empty builtins dictionary and adds path traversal protections. CVSS 8.6 with local attack vector and user interaction requirement; no evidence of active exploitation or public POC at time of analysis.
Technical ContextAI
PPTAgent (cpe:2.3:a:icip-cas:pptagent) is an agentic framework that uses LLMs to generate PowerPoint presentations by dynamically executing Python code. The vulnerability stems from CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code) in the execute_actions() function within pptagent/apis.py. The code called eval(line, {}, {func: partial_func}), passing an empty globals dictionary but leaving __builtins__ implicitly available in scope. In Python, eval() with empty globals still has access to all builtin functions (open, exec, __import__, etc.) unless explicitly restricted. This allowed LLM-generated malicious code strings to invoke arbitrary builtins for file system access, module imports, or subprocess execution. The patch replaces the empty globals with SAFE_EVAL_GLOBALS = {'__builtins__': {}} to explicitly remove builtin access. Additional hardening includes path traversal validation via resolve_path_in_workspace() to confine file operations to the designated workspace directory.
RemediationAI
Update to PPTAgent commit 418491a or later by pulling the latest code from the GitHub repository at https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00. The patch replaces unsafe eval() calls with restricted globals (SAFE_EVAL_GLOBALS = {'__builtins__': {}}) and adds resolve_path_in_workspace() to prevent path traversal attacks. If immediate patching is not feasible, implement compensating controls: restrict PPTAgent execution to isolated containers or VMs with no network access, validate and sanitize all LLM-generated code through static analysis before execution, or disable dynamic code execution features entirely if presentation generation can operate without eval(). Note that disabling eval() may break core framework functionality. Run PPTAgent under least-privilege service accounts with no access to sensitive files or credentials. Monitor process execution for unexpected child processes (shells, network tools) spawned by Python. These workarounds reduce but do not eliminate risk; patching is the only complete mitigation. Refer to GHSA-89g2-xw5c-v95p for vendor guidance.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-95 – Eval Injection
View allShare
External POC / Exploit Code
Leaving vuln.today