Repository navigation
[GHSA-89g2-xw5c-v95p] PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope - #11008
Conversation
|
Hi there @Force1ess! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
🟢 Approval recommended
The advisory adds the official PyPI reference for the fixed 1.1.36 release while preserving the existing package and vulnerability metadata.
No open issues 🎉
What changed in this PR
This pull request updates the PPTAgent security advisory with an official PyPI reference for the fixed 1.1.36 release, improving traceability to the distributed package.
Changes:
- Updates the advisory modification timestamp.
- Adds the PyPI
pptagent1.1.36 release page as a web reference. - Preserves the existing package metadata, affected ranges, severity, and CVSS information.
| File | Description |
|---|---|
advisories/github-reviewed/2026/05/GHSA-89g2-xw5c-v95p/GHSA-89g2-xw5c-v95p.json |
Adds the official PyPI 1.1.36 release reference and updates the modification timestamp. |
Review effort: Lite (auto)
Updates
Comments
Updates
Comments
Summary
This update adds an official package registry reference to the PPTAgent security advisory, providing additional evidence of the release containing the reported remediation.
Changes
Supporting evidence
Technical justification
The upstream commit documents the security-related code changes, including restrictions on evaluation globals and access to Python built-ins.
The official PyPI release page provides an authoritative record of the published package version.
Together, these references improve the connection between the upstream remediation and the distributed package release.
Scope
Only reference metadata is updated. The package name, PyPI ecosystem, affected and fixed version ranges, aliases, CVSS score and severity remain unchanged.