CVE-2026-42078: Icip-Cas Pptagent

Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days.

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary file write and directory creation via markdown_table_to_image. This issue has been patched via commit 418491a.

Affected products

• Icip-Cas Pptagent: before 418491a9a1c02d9d93194b5973bb58df35cf9d00 (fixed in 418491a9a1c02d9d93194b5973bb58df35cf9d00)

Published 2026-05-04. Last modified 2026-06-17.