Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-33057— Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py

Quick assessment

Affected
mesop-dev mesop
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mesop是Mesop开源的一个快速构建Python Web应用的UI框架。 Mesop 1.2.2及之前版本存在代码注入漏洞，该漏洞源于ai/测试模块中的/exec-py端点无条件执行未经验证的Python代码，可能导致远程代码执行。

CVSS 9.8 · Critical EPSS 4.11% · P91

Public Exploits 1

Nuclei · 1 CVE-2026-33057.yaml [template]
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-33057

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py
Source: CVE Program / CVE List V5
Vulnerability Description
Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 and below, an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings unconditionally without authentication measures, yielding standard Unrestricted Remote Code Execution. Any individual capable of routing HTTP logic to this server block will gain explicit host-machine command rights. The AI codebase package includes a lightweight debugging Flask server inside ai/sandbox/wsgi_app.py. The /exec-py route accepts base_64 encoded raw string payloads inside the code parameter natively evaluated by a basic POST web request. It saves it rapidly to the operating system logic path and injects it recursively using execute_module(module_path...). This issue has been fixed in version 1.2.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Mesop 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mesop是Mesop开源的一个快速构建Python Web应用的UI框架。 Mesop 1.2.2及之前版本存在代码注入漏洞，该漏洞源于ai/测试模块中的/exec-py端点无条件执行未经验证的Python代码，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
mesop-dev mesop < 1.2.3 -

II. Public POCs for CVE-2026-33057

# POC Description Source Link Shenlong Link
1 Mesop <= 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33057.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-33057

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-33057 (1)

Vendor Advisories for CVE-2026-33057 (1)

IV. Related Vulnerabilities

Same product: mesop
Same vendor: mesop-dev
Same weakness: CWE-94

V. Comments for CVE-2026-33057

No comments yet

Leave a comment