Threats tagged 'ghsa-89g2-xw5c-v95p'

CVE-2026-42079 is a high-severity vulnerability in PPTAgent versions prior to 1.1.36. It arises from the use of Python's eval() function on LLM-generated slide editing commands with built-in functions accessible, allowing attackers to execute arbitrary code. The vulnerability allows an attacker who can influence the LLM input to execute shell commands, potentially leading to full system compromise and data exfiltration. The issue is fixed in version 1.1.36 by restricting the globals passed to eval() to exclude built-ins.