PT-2026-26182 · Mesop · Mesop

Liyander · Published 2026-03-18 · Updated 2026-03-26 · CVE-2026-33054

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mesop versions 1.2.2 and below

Description Mesop, a Python-based UI framework, contains a Path Traversal vulnerability. This allows a user providing an untrusted state token through the UI stream payload to target files on the disk when using the standard file-based runtime backend. This can lead to application denial of service, potentially through crash loops when reading non-msgpack target files as configurations, or arbitrary file manipulation. The vulnerability is particularly impactful on systems utilizing the FileStateSessionBackend. An attacker can craft a malicious Protobuf payload and send it to the /ui stream endpoint, exploiting the unconditional passing of the state token to FileStateSessionBackend. make file path(self, token), which resolves OS traversal semantics. The state token is collected from the untrusted incoming protobuf message struct: mesop.protos.ui pb2.UserEvent.

Recommendations Update Mesop to version 1.2.3 or later.

Exploit

Fix

RCE

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-33054

GHSA-8QVF-MR4W-9X2C

Affected Products

Mesop

References · 14

• 🔥 https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33054.json · Exploit
• https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b · Patch
• https://osv.dev/vulnerability/GHSA-8qvf-mr4w-9x2c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33054 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33054 · Vendor Advisory
• https://github.com/mesop-dev/mesop · Note
• https://github.com/mesop-dev/mesop/releases/tag/v1.2.3 · Note
• https://twitter.com/TheHackerWire/status/2035476512850530635 · Twitter Post
• https://twitter.com/CveFindCom/status/2034898398743056413 · Twitter Post
• https://twitter.com/integ_sec/status/2037188046940983302 · Twitter Post
• https://twitter.com/NCIIPC/status/2035932140450558368 · Twitter Post
• https://twitter.com/0dayPublishing/status/2034893738917372167 · Twitter Post
• https://twitter.com/pulsepatchio/status/2034645333054193902 · Twitter Post