PT-2026-23726 · Mesa · Mesa

Jackiekazil · Published 2026-03-06 · Updated 2026-03-29 · CVE-2026-29075

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mesa versions prior to 3.5.1

Description Mesa is a Python library used for agent-based modeling and simulating complex systems. A flaw exists where checking out untrusted code within the benchmarks.yml workflow could allow for code execution with elevated privileges on the runner system. This issue was addressed with commit c35b8cd.

Recommendations Update to Mesa version 3.5.1 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-29075

GHSA-3J55-5Q6X-2H48

Affected Products

Mesa

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29075.json · Exploit
• https://github.com/mesa/mesa/security/advisories/GHSA-3j55-5q6x-2h48 · Vendor Advisory
• https://github.com/mesa/mesa/commit/c35b8cd67fc89dd680ae218e49b77f6e1ee07a27 · Patch
• https://osv.dev/vulnerability/CVE-2026-29075 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29075 · Security Note
• https://twitter.com/TheHackerWire/status/2030222103191187815 · Twitter Post
• https://twitter.com/TheRabbitPy/status/2038353213594685875 · Twitter Post
• https://t.me/CVEtracker/46624 · Telegram Post
• https://t.me/cveNotify/155011 · Telegram Post
• https://twitter.com/CVEnew/status/2029975480607330539 · Twitter Post