nature-image2ppt
Warn
Audited by Socket on Aug 23, 2026
1 alert found:
SecuritySecuritycli/image2ppt/runtime/formula_renderer.py
MEDIUMSecurityMEDIUM
cli/image2ppt/runtime/formula_renderer.py
No direct malware/backdoor logic is evident (no network calls, credential access, or obfuscated payloads). However, this module executes a TeX engine on attacker-controlled LaTeX (`tex`/`preamble`) and optionally enables `-shell-escape`, which can permit command execution from within the LaTeX process depending on TeX settings—making it a high-risk capability if inputs are not strictly controlled. Additionally, it runs external document conversion tools on untrusted-rendered content, expanding the attack surface.
Confidence: 78%Severity: 72%
Audit Metadata