Search
Find a vulnerability
Search criteria
2 vulnerabilities by mesa_project
CVE-2026-29075 (GCVE-0-2026-29075)
Vulnerability from nvd – Published: 2026-03-06 16:30 – Updated: 2026-03-09 15:00
VLAI
Title
Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner
Summary
Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commit c35b8cd.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/mesa/mesa/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mesa/mesa/commit/c35b8cd67fc89… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-29075",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-09T14:59:53.798140Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-09T15:00:07.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mesa",
"vendor": "mesa",
"versions": [
{
"status": "affected",
"version": "\u003c= 3.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commit c35b8cd."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T16:30:08.146Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mesa/mesa/security/advisories/GHSA-3j55-5q6x-2h48",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mesa/mesa/security/advisories/GHSA-3j55-5q6x-2h48"
},
{
"name": "https://github.com/mesa/mesa/commit/c35b8cd67fc89dd680ae218e49b77f6e1ee07a27",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mesa/mesa/commit/c35b8cd67fc89dd680ae218e49b77f6e1ee07a27"
}
],
"source": {
"advisory": "GHSA-3j55-5q6x-2h48",
"discovery": "UNKNOWN"
},
"title": "Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-29075",
"datePublished": "2026-03-06T16:30:08.146Z",
"dateReserved": "2026-03-03T20:51:43.483Z",
"dateUpdated": "2026-03-09T15:00:07.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-29075 (GCVE-0-2026-29075)
Vulnerability from cvelistv5 – Published: 2026-03-06 16:30 – Updated: 2026-03-09 15:00
VLAI
Title
Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner
Summary
Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commit c35b8cd.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/mesa/mesa/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mesa/mesa/commit/c35b8cd67fc89… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-29075",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-09T14:59:53.798140Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-09T15:00:07.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mesa",
"vendor": "mesa",
"versions": [
{
"status": "affected",
"version": "\u003c= 3.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commit c35b8cd."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T16:30:08.146Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mesa/mesa/security/advisories/GHSA-3j55-5q6x-2h48",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mesa/mesa/security/advisories/GHSA-3j55-5q6x-2h48"
},
{
"name": "https://github.com/mesa/mesa/commit/c35b8cd67fc89dd680ae218e49b77f6e1ee07a27",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mesa/mesa/commit/c35b8cd67fc89dd680ae218e49b77f6e1ee07a27"
}
],
"source": {
"advisory": "GHSA-3j55-5q6x-2h48",
"discovery": "UNKNOWN"
},
"title": "Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-29075",
"datePublished": "2026-03-06T16:30:08.146Z",
"dateReserved": "2026-03-03T20:51:43.483Z",
"dateUpdated": "2026-03-09T15:00:07.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}