PPTAgent, a framework for generating reflective PowerPoint presentations, contains a flaw that allows an attacker to execute arbitrary Python code by evaluating LLM‑generated content with eval() when builtins are present in the evaluation scope. The vulnerability is rooted in CWE‑95, reflecting the use of a dangerous dynamic execution function. If exploited, the attacker can gain full control of the underlying system where PPTAgent runs, compromising confidentiality, integrity, and availability by running any code the attacker supplies.

The affected product is PPTAgent from the icip‑cas vendor. Version information is not specified in the data, so all releases prior to the commit that introduced the patch are potentially vulnerable.

The vulnerability carries a CVSS score of 8.6, indicating high severity. No EPSS score is available, and it is not listed in CISA KEV. The likely attack vector is local or requires the attacker to supply malicious LLM‑generated code to an instance of PPTAgent; remote exploitation would depend on the environment in which the framework is deployed. The absence of a published exploit in KEV suggests the risk is high but depends on the exposure of PPTAgent to untrusted inputs.