CVE-2026-33057: Mesop Unauthenticated Remote Code Execution via Test Suite Route /exec-py
Summary
CVE-2026-33057: Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py. Affects mesop versions < 1.2.3. Fixed in 1.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mesop is an open-source package available on PyPI that provides a lightweight debugging environment for Python applications. It includes a testing module designed to facilitate the execution of Python code in a controlled environment. However, a critical vulnerability exists within this module that allows unauthenticated users to execute arbitrary code on the host machine, posing significant security risks.
Vulnerability Detail
The vulnerability arises from an explicit web endpoint in the ai/testing module that accepts untrusted Python code strings without any authentication. This endpoint, located at /exec-py, allows anyone who can send an HTTP request to execute arbitrary code on the server. The code is base64 encoded and is decoded and executed without any validation, leading to unrestricted remote code execution. This could allow an attacker to gain control over the host machine, execute commands, and potentially compromise sensitive data.
How To Fix
Latest published version: 1.3.7 as of 23 Oct 2026
pip install --upgrade "mesop==1.3.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.3
This is the first release that contains the fix.
pip install --upgrade "mesop==1.2.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the testing module or restrict access to the /exec-py endpoint by implementing firewall rules or network access controls to prevent unauthorized HTTP requests from reaching the server.
Conclusion
CVE-2026-33057 represents a significant security risk for applications using the Mesop package due to its potential for unauthorized remote code execution. It is crucial for developers to update to the patched version and implement necessary security measures to protect their systems.
See every vulnerability recorded for mesop →
FAQ
CVE-2026-33057 is a critical vulnerability in the Mesop package that allows unauthenticated remote code execution through the /exec-py endpoint.
If your application uses the vulnerable version of Mesop and is publicly accessible, an attacker could exploit this vulnerability to execute arbitrary code on your server.
If you cannot update the package, implement strict access controls to the /exec-py endpoint or disable the testing module until a patch can be applied.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of CVE-2026-33057 is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for mesop.
