CVE-2026-33057: Mesop-dev Mesop RCE Vulnerability

CVE-2026-33057 Overview

CVE-2026-33057 is a critical Remote Code Execution (RCE) vulnerability affecting Mesop, a Python-based UI framework that enables developers to build web applications. The vulnerability exists in versions 1.2.2 and below, where an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings without any authentication measures, resulting in unrestricted remote code execution capabilities.

Critical Impact

Any individual capable of routing HTTP traffic to the vulnerable server endpoint can gain complete host-machine command execution rights, potentially leading to full system compromise.

Affected Products

• mesop-dev mesop versions 1.2.2 and below
• Mesop AI sandbox debugging Flask server (ai/sandbox/wsgi_app.py)
• Systems exposing the /exec-py route to untrusted networks

Discovery Timeline

• 2026-03-20 - CVE-2026-33057 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33057

Vulnerability Analysis

This vulnerability represents a severe case of Code Injection (CWE-94) within the Mesop AI codebase package. The vulnerable component is a lightweight debugging Flask server located at ai/sandbox/wsgi_app.py. The /exec-py route is designed to accept base64-encoded raw Python code strings via the code parameter through a standard POST web request.

The critical flaw lies in the complete absence of authentication or authorization controls on this endpoint. When a request is received, the server decodes the base64-encoded payload, saves it to the operating system's file path, and then recursively executes it using the execute_module(module_path...) function. This chain of operations provides attackers with direct access to execute arbitrary Python code on the host system.

Root Cause

The root cause of this vulnerability is the unconditional acceptance and execution of untrusted user-supplied Python code without implementing any security controls. The debugging functionality was included in the AI testing module infrastructure but lacked essential security measures such as:

• Authentication requirements for accessing the endpoint
• Input validation and sanitization
• Sandboxing or isolation of code execution
• Access control restrictions limiting who can invoke the endpoint

Attack Vector

The attack vector is network-based, requiring no privileges, authentication, or user interaction. An attacker can exploit this vulnerability by sending a crafted HTTP POST request to the /exec-py endpoint with a base64-encoded Python payload in the code parameter.

The exploitation process involves:

1. Encoding malicious Python code as a base64 string
2. Sending a POST request to the vulnerable /exec-py endpoint
3. The server decodes the payload and writes it to the filesystem
4. The code is executed via execute_module() with full host privileges

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-gjgx-rvqr-6w6v.

Detection Methods for CVE-2026-33057

Indicators of Compromise

• Unexpected HTTP POST requests targeting the /exec-py endpoint
• Base64-encoded payloads in web server logs containing the code parameter
• Unusual Python process execution originating from the Mesop application directory
• New or modified files appearing in the ai/sandbox/ directory structure

Detection Strategies

• Monitor web application logs for POST requests to /exec-py routes
• Implement network-based intrusion detection rules to identify base64-encoded Python code in HTTP parameters
• Deploy file integrity monitoring on the ai/sandbox/ directory to detect unauthorized file writes
• Utilize endpoint detection and response (EDR) solutions to identify anomalous Python process spawning

Monitoring Recommendations

• Configure alerting for any access attempts to the /exec-py endpoint from external IP addresses
• Implement application-layer firewalls to block requests containing suspicious base64-encoded payloads
• Enable verbose logging on Flask applications to capture full request bodies for forensic analysis
• Monitor system calls and process creation events associated with the Mesop application user context

How to Mitigate CVE-2026-33057

Immediate Actions Required

• Upgrade Mesop to version 1.2.3 or later immediately
• If upgrading is not immediately possible, disable or remove the AI sandbox debugging server entirely
• Restrict network access to development and testing infrastructure containing the vulnerable endpoint
• Audit logs for any historical exploitation attempts against the /exec-py route

Patch Information

The vulnerability has been addressed in Mesop version 1.2.3. The fix removes the unsafe code execution endpoint from the AI testing module infrastructure. Organizations should update to this version or later to remediate the vulnerability.

Patch commit: GitHub Commit Changes

Security Advisory: GitHub Security Advisory GHSA-gjgx-rvqr-6w6v

Workarounds

• Remove or disable the ai/sandbox/wsgi_app.py Flask server from production deployments
• Implement network-level access controls to block all traffic to the /exec-py endpoint
• Deploy a web application firewall (WAF) rule to deny requests matching the vulnerable endpoint pattern
• Ensure development and testing infrastructure is isolated from production networks and not publicly accessible

# Configuration example
# Block access to the vulnerable endpoint using nginx
location /exec-py {
    deny all;
    return 403;
}

# Or remove the vulnerable file entirely
rm -f /path/to/mesop/ai/sandbox/wsgi_app.py