Loading story…
Two high-severity vulnerabilities in the Python web UI framework Mesop exposed applications to unauthenticated compromise in version 1.2.2 and earlier. The most critical issue, tracked as CVE-2026-33057, allowed remote code execution through an exposed /exec-py route in Mesop's AI testing infrastructure, where a debugging Flask server accepted base64-encoded Python code and executed it without authentication. The flaw was assigned CWE-94 and a CVSS 3.1 score vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
A second flaw, CVE-2026-33054, let attackers exploit path traversal via an untrusted state_token processed by FileStateSessionBackend, enabling file write or deletion outside intended application boundaries and potentially causing denial-of-service crash loops. That issue was classified as CWE-22 with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Mesop addressed both vulnerabilities in version 1.2.3, and GitHub published security advisories and patch references for the fixes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Security advisory information for the Mesop vulnerabilities was published on March 20, 2026, including notice that CVE-2026-33054 was newly received by security-advisories@github.com that day. The advisories documented impact, affected versions, and remediation in Mesop 1.2.3.
Mesop fixed both the path traversal issue in FileStateSessionBackend and the unauthenticated /exec-py remote code execution flaw in version 1.2.3. The fixes were referenced in security advisory material and an associated patch commit.
Mesop's file-based runtime backend allowed path traversal through an untrusted state_token in the UI stream payload, which could cause crash loops and arbitrary file write or deletion outside intended boundaries. The issue was later assigned CVE-2026-33054.
Mesop contained an exposed AI testing endpoint, /exec-py, that accepted and executed untrusted Python code without authentication, enabling remote code execution in version 1.2.2 and earlier. The flaw was later tracked as CVE-2026-33057.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several open source projects disclosed serious vulnerabilities affecting developer and infrastructure tooling, including remote code execution, SQL injection, server-side request forgery, prompt-driven query injection, and path traversal. **Coder Workspace Agent** patched `GHSA-QRWJ-VH9X-GW5V`, a cross-agent SSRF flaw that let an authenticated attacker controlling one workspace agent abuse HTTP `307`/`308` redirects to replay privileged requests to another agent, enabling cross-tenant file access, file writes, and command execution; fixes were released in versions `v2.34.4`, `v2.33.10`, `v2.32.9`, and `v2.29.19 ESR`. **Coolify** disclosed a critical authenticated command injection issue tied to unsafe handling of deployment fields such as `dockerfile_location`, allowing RCE and secrets exposure through deployment logs, while **OpenRemote** fixed `GHSA-cgfv-jrfp-2r7v`, an authenticated SQL injection bug in datapoint crosstab export that could expose other tenants’ data, Keycloak configuration, and encrypted credentials. Additional disclosures affected AI and package-management components. **Langroid** fixed a prompt-injection-driven flaw in `Neo4jChatAgent` that executed LLM-generated Cypher without validation, allowing unauthorized graph operations and possible OS-level impact when dangerous Neo4j procedures were enabled; the issue was resolved in version `0.65.5` with new safety controls that were also extended to `ArangoChatAgent`. **pnpm** also reported a path traversal weakness in `configDependencies` processing from `pnpm-lock.yaml`, where a malicious repository could force symlink creation outside `node_modules/.pnpm-config` even with `--ignore-scripts`, creating a filesystem write primitive within or potentially beyond the project directory.
Jul 10, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Researchers disclosed multiple security flaws affecting AWS MCP components, including a local file inclusion bug in the AWS Remote MCP Server and a critical command injection issue in `aws-mcp-server`. Varonis said authenticated users could abuse AWS CLI shorthand syntax, specifically the `@=` operator passed through the `aws___call_aws` tool, to read arbitrary files from the underlying host even when `FileAccessMode=NO_ACCESS` was enabled. AWS assigned **CVE-2026-4270** to the file access restriction bypass and said the issue was fixed in `aws-api-mcp-server` version **1.3.9**; the exposure affected the public endpoint `aws-mcp.us-east-1.api.aws` as well as self-hosted or forked deployments. A separate flaw, tracked as **CVE-2026-5058** and published by Trend Micro's Zero Day Initiative as **ZDI-26-246**, allows unauthenticated remote code execution in `aws-mcp-server` because user-supplied input in the allowed-commands list is not properly validated before being used in a system call. ZDI rated the bug **CVSS 9.8** and said successful exploitation lets attackers run arbitrary code in the MCP server context; the advisory was released as a 0-day after the vendor rejected the report. The disclosures landed alongside another AWS bulletin for **CVE-2026-4269**, an improper S3 ownership verification issue in the Bedrock AgentCore Starter Toolkit, underscoring broader security concerns around MCP-related tooling and the need for immediate patching and review of derivative implementations.
Jun 29, 2026