CVE-2026-33057: Mesop-dev Mesop RCE Vulnerability

CVE-2026-33057 Overview

CVE-2026-33057 is a critical Remote Code Execution (RCE) vulnerability affecting Mesop, a Python-based UI framework that enables developers to build web applications. The vulnerability exists in versions 1.2.2 and below, where an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings without any authentication measures, resulting in unrestricted remote code execution capabilities.

Critical Impact
Any individual capable of routing HTTP traffic to the vulnerable server endpoint can gain complete host-machine command execution rights, potentially leading to full system compromise.

Affected Products

mesop-dev mesop versions 1.2.2 and below
Mesop AI sandbox debugging Flask server (ai/sandbox/wsgi_app.py)
Systems exposing the /exec-py route to untrusted networks

Discovery Timeline

2026-03-20 - CVE-2026-33057 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33057

Vulnerability Analysis

This vulnerability represents a severe case of Code Injection (CWE-94) within the Mesop AI codebase package. The vulnerable component is a lightweight debugging Flask server located at ai/sandbox/wsgi_app.py. The /exec-py route is designed to accept base64-encoded raw Python code strings via the code parameter through a standard POST web request.

The critical flaw lies in the complete absence of authentication or authorization controls on this endpoint. When a request is received, the server decodes the base64-encoded payload, saves it to the operating system's file path, and then recursively executes it using the execute_module(module_path...) function. This chain of operations provides attackers with direct access to execute arbitrary Python code on the host system.

Root Cause

The root cause of this vulnerability is the unconditional acceptance and execution of untrusted user-supplied Python code without implementing any security controls. The debugging functionality was included in the AI testing module infrastructure but lacked essential security measures such as:

Authentication requirements for accessing the endpoint
Input validation and sanitization
Sandboxing or isolation of code execution
Access control restrictions limiting who can invoke the endpoint

Attack Vector

The attack vector is network-based, requiring no privileges, authentication, or user interaction. An attacker can exploit this vulnerability by sending a crafted HTTP POST request to the /exec-py endpoint with a base64-encoded Python payload in the code parameter.

The exploitation process involves:

Encoding malicious Python code as a base64 string
Sending a POST request to the vulnerable /exec-py endpoint
The server decodes the payload and writes it to the filesystem
The code is executed via execute_module() with full host privileges

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-gjgx-rvqr-6w6v.

Detection Methods for CVE-2026-33057

Indicators of Compromise

Unexpected HTTP POST requests targeting the /exec-py endpoint
Base64-encoded payloads in web server logs containing the code parameter
Unusual Python process execution originating from the Mesop application directory
New or modified files appearing in the ai/sandbox/ directory structure

Detection Strategies

Monitor web application logs for POST requests to /exec-py routes
Implement network-based intrusion detection rules to identify base64-encoded Python code in HTTP parameters
Deploy file integrity monitoring on the ai/sandbox/ directory to detect unauthorized file writes
Utilize endpoint detection and response (EDR) solutions to identify anomalous Python process spawning

Monitoring Recommendations

Configure alerting for any access attempts to the /exec-py endpoint from external IP addresses
Implement application-layer firewalls to block requests containing suspicious base64-encoded payloads
Enable verbose logging on Flask applications to capture full request bodies for forensic analysis
Monitor system calls and process creation events associated with the Mesop application user context

How to Mitigate CVE-2026-33057

Immediate Actions Required

Upgrade Mesop to version 1.2.3 or later immediately
If upgrading is not immediately possible, disable or remove the AI sandbox debugging server entirely
Restrict network access to development and testing infrastructure containing the vulnerable endpoint
Audit logs for any historical exploitation attempts against the /exec-py route

Patch Information

The vulnerability has been addressed in Mesop version 1.2.3. The fix removes the unsafe code execution endpoint from the AI testing module infrastructure. Organizations should update to this version or later to remediate the vulnerability.

Patch commit: GitHub Commit Changes

Security Advisory: GitHub Security Advisory GHSA-gjgx-rvqr-6w6v

Workarounds

Remove or disable the ai/sandbox/wsgi_app.py Flask server from production deployments
Implement network-level access controls to block all traffic to the /exec-py endpoint
Deploy a web application firewall (WAF) rule to deny requests matching the vulnerable endpoint pattern
Ensure development and testing infrastructure is isolated from production networks and not publicly accessible

bash

# Configuration example
# Block access to the vulnerable endpoint using nginx
location /exec-py {
    deny all;
    return 403;
}

# Or remove the vulnerable file entirely
rm -f /path/to/mesop/ai/sandbox/wsgi_app.py