CVE-2026-29075 HIGH

CVE-2026-29075: Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner

Vendor Mesa

Product mesa

Weakness CWE-94 · Code injection

Published March 6, 2026

Last update March 9, 2026

View on NVD All CVEs

CVSS base score

8.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commit c35b8cd.

Key dates

02Disclosure timeline

March 6, 2026 CVE published

March 9, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-29075 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html

Related vulnerabilities

04Related CVE

CVE-2025-3642 Moodle: authenticated remote code execution risk in the moodle lms equella repository CVE-2022-0845 Code Injection in pytorchlightning/pytorch-lightning CVE-2024-11012 Notibar – Notification Bar for WordPress <= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text CVE-2025-15393 Kohana KodiCMS Layout API Endpoint file.php save code injection CVE-2026-23852 SiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attribute