CVE-2026-29075

Katalog CVE

CVSS 9.8 · Critical EPSS 0,54%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada mesa project mesa. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commit c35b8cd.

Rincian

Terbit di NVD

6 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mesa/mesa/security/advisories/GHSA-3j55-5q6x-2h48 mitigasi · advisory vendor
• https://github.com/mesa/mesa/commit/c35b8cd67fc89dd680ae218e49b77f6e1ee07a27 patch