Skip to content
OpenAdvisories
High · 8.3 Public exploit CVE-2026-29075 EUVD-2026-10045

Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner

Published Mar 6, 2026 · Updated Mar 9, 2026 · Assigned by GitHub_M

Vendor: mesa Product: mesa

Description

Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commit c35b8cd.

Affected products

VendorProductAffectedFixed
mesa mesa <= 3.5.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • pvharmo2/gha-lab-ca4fa82ac5 ★ 0 · Sep 4, 2026

    Security-research lab: reproduction of CVE-2026-29075 (GHSA-3j55-5q6x-2h48) in mesa/mesa benchmarks.yml pull_request_target workflow — single-commit snapshot for authorized vulnerability reproduction.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References