VulnerabilityDeferred

CVE-2026-42078

Prior to commit 418491a, PPTAgent is vulnerable to arbitrary file write and directory creation via markdown_table_to_image.

MEDIUM 4.6EPSS 0.20%

Does this matter?

Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.

Description

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary file write and directory creation via markdown_table_to_image. This issue has been patched via commit 418491a.

CVSS 3.1: 4.6 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
EPSS: 0.20% probability · 10th percentile
CISA KEV: Not listed
Weakness: CWE-22
Source: security-advisories@github.com

References

https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00
https://github.com/icip-cas/PPTAgent/security/advisories/GHSA-hrcw-xc63-g29m

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.