CVE-2026-33057

The Mesop Python-based UI framework (versions 1.2.2 and below ) is vulnerable to Unrestricted Remote Code Execution (RCE) . The flaw exists in the ai/ testing module infrastructure, where a lightweight debugging Flask server located at ai/sandbox/wsgi_app.py lacks authentication. The /exec-py rou...

CVE-2026-33054

CVE-2026-33054 affects the Mesop Python UI framework (versions ≤ 1.2.2) and enables a Path Traversal via the UI stream payload when FileStateSessionBackend is used. An untrusted state_token can target arbitrary files on disk, causing denial of service (crash loops) or unauthorized file writes/del...