CVE-2026-33054 - Vulnerability Analysis

Overview

Mesop <= 1.2.2 contains a path traversal caused by untrusted state_token in UI stream payload, letting attackers manipulate arbitrary files or cause denial of service, exploit requires use of FileStateSessionBackend.

Severity & Score

Impact

Attackers can manipulate files or cause application denial of service, potentially disrupting service availability.

Mitigation

Upgrade to version 1.2.3.

References

• https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b
• https://github.com/mesop-dev/mesop/releases/tag/v1.2.3
• https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 20, 2026

🔴 CVE-2026-33054 - Critical (10) Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted state_token through the UI stream payload to arbitrarily ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33054/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner