medium4.6
CVE-2026-42078
PPTAgent: Arbitrary File Write + Directory Creation via markdown_table_to_image
Impact
PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary file write and directory creation via markdown_table_to_image. This issue has been patched via commit 418491a.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pptagent | < 1.1.36 | 1.1.36 |