mesa vulnerabilities

Products

• mesa 1
• mesadevrest 1
• mesadevsaguaro 1
• mesadevsdk 1

Latest mesa CVEs

Newest publication first

1. CVE-2026-45321 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

   Published 2026-05-12

   Critical·CVSS 9.6 EPSS 3.3% CISA KEV added 2026-05-27 Ransomware Exploited in the wild

   On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publis...

2. CVE-2026-29075 Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner

   Published 2026-03-06

   Critical·CVSS 9.8

   Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.