What is CVE-2026-29075?

CVE-2026-29075 is a high-severity vulnerability in Mesa, classified under Code Injection. CVSS score: 8.3/10. Published 2026-03-06.

How severe is CVE-2026-29075?

High severity. CVSS v3 base score is 8.3 out of 10.

RCE in Mesa

CVE-2026-29075

Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner. This issue has been patched via commit c35b8cd.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.004 (29.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L.

Affected products

Mesa — versions <= 3.5.0
Mesa_project Mesa

Weakness classification (CWE)

CWE-94 — Code Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-29075?: CVE-2026-29075 is a high-severity vulnerability in Mesa, classified under Code Injection. CVSS score: 8.3/10. Published 2026-03-06.
How severe is CVE-2026-29075?: High severity. CVSS v3 base score is 8.3 out of 10.