Vulnerability · Published Mar 6, 2026 · Assigned by GitHub_M
CVE-2026-29075Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner
High 8.3
In plain English
A high-severity code injection in mesa from mesa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)8.3High
Exploit odds (30 days)0.4%top 64.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commit c35b8cd.
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
References
- https://github.com/mesa/mesa/security/advisories/GHSA-3j55-5q6x-2h48 x_refsource_CONFIRM
- https://github.com/mesa/mesa/commit/c35b8cd67fc89dd680ae218e49b77f6e1ee07a27 x_refsource_MISC