CVE-2026-29075CWE-94

Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner

High · published March 6, 2026

CVSS v3.1
8.3
EPSS
1%
Percentile
44.7
In the wild
Unconfirmed
What it is

Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commit c35b8cd.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00541 · 44.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-03-06T16:30Z
EPSS history
Timeline
  • 06 MAR 16:30Z
    Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner
    cvelistv5