Paper/Archive/CVE-2026-29075

CVE-2026-29075

mesa mesa — Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 32.6.326 × 206.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commit c35b8cd.

Affected

ProductAffectedFixed inSource

mesa<= 3.5.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

GitHub_M (CNA)8.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/mesa/mesa/security/advisories/GHSA-3j55-5q6x-2h48 refgithub.com/mesa/mesa/commit/c35b8cd67fc89dd680ae218e49b77f6e1ee07a27