CVE-2026-29075 - Vulnerability Analysis

Overview

Mesa <= 3.5.0 contains a remote code execution caused by checking out untrusted code in benchmarks.yml workflow, letting attackers execute code in privileged runner, exploit requires untrusted code checkout.

Severity & Score

Impact

Attackers can execute arbitrary code with privileged runner access, potentially compromising the entire system.

Mitigation

Update to a version after 3.5.0 with commit c35b8cd applied.

References

• https://github.com/mesa/mesa/commit/c35b8cd67fc89dd680ae218e49b77f6e1ee07a27
• https://github.com/mesa/mesa/security/advisories/GHSA-3j55-5q6x-2h48

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 7, 2026

🟠 CVE-2026-29075 - High (8.3) Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privil... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29075/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner