CVE-2026-33057

The Mesop Python-based UI framework (versions 1.2.2 and below ) is vulnerable to Unrestricted Remote Code Execution (RCE) . The flaw exists in the ai/ testing module infrastructure, where a lightweight debugging Flask server located at ai/sandbox/wsgi_app.py lacks authentication. The /exec-py rou...

CVE-2026-34824

CVE-2026-34824 targets the Mesop Python-based UI framework. A vulnerability in the WebSocket handler from version 1.2.3 up to, but not including, 1.2.5 allows an unauthenticated attacker to flood the server with rapid WebSocket messages, causing unbounded thread creation. This thread exhaustion l...

CVE-2026-33054

CVE-2026-33054 affects the Mesop Python UI framework (versions ≤ 1.2.2) and enables a Path Traversal via the UI stream payload when FileStateSessionBackend is used. An untrusted state_token can target arbitrary files on disk, causing denial of service (crash loops) or unauthorized file writes/del...