CVE-2026-33057

🗓️ 20 Mar 2026 07:16:59Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 15 Views🌐 WEB

Mesop unauthenticated remote code execution via /exec-py in 1.2.2 and earlier; fixed in 1.2.3.

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2026-33057	20 Mar 202607:16	–	attackerkb
Circl	CVE-2026-33057	17 Mar 202620:58	–	circl
CNNVD	Mesop 代码注入漏洞	20 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-33057 Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py	20 Mar 202607:16	–	cvelist
Github Security Blog	Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py	18 Mar 202620:05	–	github
Nuclei	Mesop AI Sandbox <= 1.2.2 - Remote Code Execution	22 Jun 202605:20	–	nuclei
NVD	CVE-2026-33057	20 Mar 202608:16	–	nvd
OSV	CVE-2026-33057 Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py	20 Mar 202607:16	–	osv
OSV	GHSA-GJGX-RVQR-6W6V Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py	18 Mar 202620:05	–	osv
Positive Technologies	PT-2026-26183	18 Mar 202600:00	–	ptsecurity

NVD

Vulners

Node

mesop-dev mesopRange<1.2.3

[
  {
    "vendor": "mesop-dev",
    "product": "mesop",
    "versions": [
      {
        "version": "< 1.2.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/mesop-dev/mesop/commit/825f55970c20686de3f28e2c66df4d74e9d4db47
github	www.github.com/mesop-dev/mesop/security/advisories/GHSA-gjgx-rvqr-6w6v

Parameter	Position	Path	Description	CWE
code	request body	/exec-py	Unrestricted Remote Code Execution via /exec-py endpoint where base64-encoded content in the code parameter is evaluated without authentication.	CWE-94

17 Jun 2026 10:36Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.8

EPSS0.05289

SSVC

CWE-94