{"data":{"id":"fc152021-e34c-4e8c-9d8a-b9d3237e3b9d","title":"GHSA-gjgx-rvqr-6w6v: Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py","summary":"The Mesop test sandbox server, in ai/sandbox/wsgi_app.py, exposes a /exec-py route that accepts a base64-encoded Python string in the code form parameter, writes it to disk and runs it with execute_module(module_path...). The route performs no authentication, so any client that can reach it can run arbitrary commands on the host. The advisory rates the impact as trivial severity for publicly exposed or unfirewalled deployments.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-gjgx-rvqr-6w6v","publishedAt":"2026-03-18T20:05:00.000Z","cveId":"CVE-2026-33057","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mesop@<= 1.2.2 (fixed: 1.2.3)"],"affectedPackageNames":["mesop"],"affectedPackageRefs":["pypi:mesop"],"affectedVendors":[],"affectedVendorsRaw":["Mesop"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.05295,"epssCheckedAt":"2026-11-04T06:10:14.410Z","kevDateAdded":null,"advisoryAliases":["GHSA-gjgx-rvqr-6w6v"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-03-18T20:05:00.000Z","fixReleasedAt":"2026-03-16T18:01:44.905Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:39:48.646Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mesop","fixedVersion":"1.2.3","matchedVersion":"1.2.3","fixReleasedAt":"2026-03-16T18:01:44.905Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:39:48.500Z"}]}}