Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
This vulnerability has been fixed in https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00. The savegeneratedslides MCP tool accepts a pptxpath argument and writes the generated PPTX file to that path without any workspace restriction or path validation: The call to pptx.parent.mkdir(parents=True, existok=True) creates any intermediate directories, and self.emptyprs.save(pptxpath) writes a valid PPTX binary (ZIP archive) to the specified path. No isrelativeto(workspace) check is performed — contrast with downloadfile in deeppresenter/tools/search.py:290, which correctly enforces workspace confinement. The server changes directory to WORKSPACE (if set) on startup, so relative paths land in the workspace. Absolute paths, however, reach any filesystem location accessible to the server process. Impact The concrete attack scenarios include 1. Cron persistence (root-running server): pptxpath = "/etc/cron.d/backdoor" → writes a PPTX ZIP to a path the…
Recommended action: Upgrade to 1.1.36 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This vulnerability has been fixed in https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00. CodeExecutor.executeactions (pptagent/apis.py:126-205) processes LLM-generated slide editing actions using Python's eval(): The call eval(line, {}, {func: partialfunc}) passes an empty dict as globals. Per Python's language reference: "If the globals dictionary is present and does not contain a value for the key builtins, a reference to the dictionary of the built-in module builtins is inserted under that key before the expression is parsed." This means import, open, exec, compile, and all other built-in functions are available inside the evaluated expression. The validation before eval only checks 1) The function name matches ^[a-z]+[a-z]+ (snakecase pattern) and 2) The function name is in self.registeredfunctions. The arguments to the function are not validated. If an attacker can influence the LLM's generated edit actions (via prompt injection through…
Recommended action: Upgrade to 1.1.36 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The markdowntabletoimage tool accepts a caller-controlled path parameter and passes it directly to gethtmltableimage: os.makedirs(parentdir) creates arbitrary directory trees, and Html2Image.screenshot writes the rendered image to parentdir/basename. Unlike downloadfile in the same project, there is no isrelativeto(workspace) guard. This behaviour can be fixed with the same pattern as the above. Impact The concrete attack scenarios include - SSH key replacement: path = "/home/user/.ssh/authorizedkeys" — replaces the authorizedkeys file with an image binary (breaks - SSH but could be an image crafted with a specific PNG/JPEG payload). - Web shell: path = "/var/www/html/uploads/shell.php" — writes the rendered PNG there; the file has the .php extension but PNG content; combined with Apache Options +MultiViews or file-include vulnerabilities could be dangerous. - Directory creation oracle: path = "/root/test/probe.png" — if the directory is created, confirms the target path…
Recommended action: Upgrade to 1.1.36 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.