VulnSocial

CVE-2026-33057Disclosure(mesop-dev / mesop)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch mesop-dev mesop systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 and below, an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings unconditionally without authentication measures, yielding standard Unrestricted Remote Code Execution. Any individual capable of routing HTTP logic to this server block will gain explicit host-machine command rights. The AI codebase package includes a lightweight debugging Flask server inside ai/sandbox/wsgi_app.py. The /exec-py route accepts base_64 encoded raw string payloads inside the code parameter natively evaluated by a basic POST web request. It saves it rapidly to the operating system logic path and injects it recursively using execute_module(module_path...). This issue has been fixed in version 1.2.3.

mesop-dev CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mesop

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 4 mentions (2026-03-20); latest day: 1
  • 5 total mentions across 2 days

Affected systems

Vendors
mesop-dev
Products
mesop

Deep dive

Activity timeline5 mentions / 2d
01234Mentions · 2026-03-20: 4Mentions · 2026-04-30: 1PoC Mentioned / Linked · 2026-04-30: 1Patch / Workaround · 2026-03-20: 2Technical Details · 2026-03-20: 3Technical Details · 2026-04-30: 103-2004-30
Signal classification2 categories
Disclosure
360.0%
Patch
240.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-03-204
Disclosure2Patch2
2026-04-301
Disclosure1
Full discourse5 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-33057 - critical 🚨 Mesop AI Sandbox <= 1.2.2 - Remote Code Execution > Mesop <= 1.2.2 contains an unrestricted remote code execution caused by unauthenticat... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-33057 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet announces CVE-2026-33057, a critical unrestricted remote code execution vulnerability in Mesop AI Sandbox <= 1.2.2, with a link to details but no PoC code, patches, or evidence of exploitation.

    00011101
    942 followersView on X
  • CVEFind.com@CveFindCom
    Patch

    [CVE-2026-33057: CRITICAL] Python-based UI framework Mesop versions 1.2.2 &amp; below have a critical security flaw allowing unrestricted remote code execution via unauthenticated endpoints, fixed in 1.2.3.#cve,CVE-2026-33057,#cybersecurity https://cvefind.com/CVE-2026-33057

    Post summary

    The post discloses a critical RCE flaw in Mesop 1.2.2 and earlier, which is resolved in version 1.2.3.

    0001046
    604 followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🔴 CVE-2026-33057 - Critical Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 and below, an explicit web endpoint inside the ai/ testing module infrastructure direct... https://www.thehackerwire.com/vulnerability/CVE-2026-33057/ https://t.co/J5c407V9K4

    Post summary

    The message announces CVE‑2026‑33057 as a critical vulnerability in Mesop versions 1.2.2 and below, noting an exposed web endpoint, but provides no further technical or mitigation details.

    0000050
    138 followersView on X
  • PulsePatch.io@pulsepatchio
    Patch

    Unauthenticated Remote Code Execution (CVE-2026-33057) impacts `Mesop` via its `/exec-py` route. Admins should identify affected systems and apply network restrictions. #RCE #Python #InfoSec https://www.pulsepatch.io/posts/cve-2026-33057-mesop-unauthenticated-rce

    Post summary

    The message announces an unauthenticated RCE in Mesop’s /exec-py route and urges administrators to restrict network access as a mitigation.

    0000033
    1 followersView on X
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2026-33057: Mesop Affected by Unauthenticate... Base64-encoded Python exec via `/exec-py` with zero auth - whoever thought shipping a debug Flask route in production d... https://zerodaysignal.com/vulnerability/CVE-2026-33057 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The tweet announces CVE-2026-33057, detailing an unauthenticated remote code execution via a debug Flask route that accepts base64‑encoded Python.

    0000071
    155 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmesop-devmesop---

Explore more

Back to dashboardmesop-dev CVEsmesop vulnerabilities