Mesop-Dev Mesop vulnerabilities

CVE-2026-33057 [CRITICAL] CWE-94 CVE-2026-33057: Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 and below, an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings unconditionally without authentication measures, yielding standard Unrestricted Remote Code Execution. Any individual capab

CVE-2026-33054 [CRITICAL] CWE-22 CVE-2026-33054: Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted state_token through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application

CVE-2025-30358 [HIGH] CWE-915 CVE-2025-30358: Mesop is a Python-based UI framework that allows users to build web applications. A class pollution Mesop is a Python-based UI framework that allows users to build web applications. A class pollution vulnerability in Mesop prior to version 0.14.1 allows attackers to overwrite global variables and class attributes in certain Mesop modules during runtime. This vulnerability could directly lead to a denial of service (DoS) attack against the server. Add

CVE-2026-34824 [HIGH] CWE-125 CVE-2026-34824: Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unb

CVE-2024-45601 [HIGH] CWE-20 Mesop has a local file Inclusion via static file serving functionality Mesop has a local file Inclusion via static file serving functionality A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validation in a specific endpoint. This could have allowed an attacker to access files not intended to be served. Use