Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The /csp endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print() without escaping control characters. A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in an ANSI-capable terminal, these sequences can manipulate the displayed output (e.g., clear the screen, hide text, or inject misleading messages), affecting the integrity of operator-facing logs. Details The CSP reporting endpoint accepts arbitrary JSON and prints several request fields directly: mesop/server/staticfileserving.py Since these values are written to stdout without sanitization, ANSI escape sequences supplied by a remote client are preserved and interpreted by ANSI-compatible terminals. PoC Send the following request: The request is accepted (HTTP 204), and the injected escape sequences are written to stdout unchanged. When the captured output is rendered in a VT100-compatible…
Recommended action: Upgrade to 1.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. Details The vulnerability stems from an architectural flaw in how incoming WebSocket messages are processed. In the mesop/server/server.py file, the handlewebsocket function listens for incoming messages and immediately spawns a new threading.Thread for every successfully parsed uirequest. There is no thread pool, message queue, or rate-limiting mechanism implemented to restrict the number of concurrent threads spawned per connection. Vulnerable code snippet in mesop/server/server.py: PoC To reproduce this vulnerability, you only need a running instance of a…
Recommended action: Upgrade to 1.2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings unconditionally without authentication measures, yielding standard Unrestricted Remote Code Execution. Any individual capable of routing HTTP logic to this server block will gain explicit host-machine command rights. Details The AI codebase package includes a lightweight debugging Flask server inside ai/sandbox/wsgiapp.py. The /exec-py route accepts base64 encoded raw string payloads inside the code parameter natively evaluated by a basic POST web request. It saves it rapidly to the operating system logic path and injects it recursively using executemodule(modulepath...). PoC Impact This presents trivial severity for systems publicly exposed or lacking strictly verified boundary firewalls due to absolute unauthenticated command injection privileges targeting the direct execution interpreter running this service sandbox.
Recommended action: Upgrade to 1.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Path Traversal vulnerability allows any user (or attacker) supplying an untrusted statetoken through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service (via crash loops when reading non-msgpack target files as configurations), or arbitrary file manipulation. Details When the framework is configured to use the disk-based session backend (FileStateSessionBackend), the user's statetoken actively dictates where the runtime session state is physically saved or queried natively on disk. In mesop/server/server.py, specifically the uistream endpoint, the event.statetoken is collected directly from the untrusted incoming protobuf message struct: mesop.protos.uipb2.UserEvent. Because this is unconditionally passed to FileStateSessionBackend.makefilepath(self, token), it evaluates standard path operators (e.g. ../../../). Python's standard library natively resolves OS traversal…
Recommended action: Upgrade to 1.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
From @jackfromeast and @superboy-zjc: We have identified a class pollution vulnerability in Mesop (<= 0.14.0) application that allows attackers to overwrite global variables and class attributes in certain Mesop modules during runtime. This vulnerability could directly lead to a denial of service (DoS) attack against the server. Additionally, it could also result in other severe consequences given the application's implementation, such as identity confusion, where an attacker could impersonate an assistant or system role within conversations. This impersonation could potentially enable jailbreak attacks when interacting with large language models (LLMs). Just like the Javascript's prototype pollution, this vulnerability could leave a way for attackers to manipulate the intended data-flow or control-flow of the application at runtime and lead to severe consequnces like RCE when gadgets are available.
Recommended action: Upgrade to 0.14.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validation in a specific endpoint. This could have allowed an attacker to access files not intended to be served. Users are strongly advised to update to the latest version of Mesop immediately. The latest version includes a fix for this vulnerability. We would like to thank @Letm3through for reporting this issue and proposing mitigations to address this issue.
Recommended action: Upgrade to 0.12.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.