CVE-2026-33054: critical vulnerability in mesop-dev mesop
Mesop: Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 0.7%
Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted state_token through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service (via crash loops when reading non-msgpack target files as configurations), or arbitrary file manipulation. This vulnerability heavily exposes systems hosted utilizing FileStateSessionBackend. Unauthorized malicious actors could interact with arbitrary payloads overwriting or explicitly removing underlying service resources natively outside the application bounds. This issue has been fixed in version 1.2.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
mesop-dev · mesopRelated CVEs — mesop-dev mesop
In the same product, most dangerous first.
CVE-2026-33057CRITICALMesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-pyEPSS 5.4%CVE-2026-34824HIGHMesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of ServiceEPSS 0.8%CVE-2025-30358HIGHMesop Class Pollution vulnerability leads to DoS and Jailbreak attacksEPSS 0.7%CVE-2026-77357HIGHMesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the serverEPSS 0.5%CVE-2026-93421MEDIUMMesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting EndpointEPSS 0.5%