The vulnerability CVE-2026-33057 affects the mesop Python UI framework, specifically versions 1.2.2 and earlier. Mesop includes a lightweight Flask debugging server within its AI codebase, notably in ai/sandbox/wsgi_app.py, which exposes an endpoint /exec-py. This endpoint accepts POST requests containing a base64-encoded Python code string in the 'code' parameter. The server decodes and saves this code to the operating system path, then executes it recursively using the execute_module function. Critically, this endpoint lacks any authentication or input validation, allowing any remote attacker capable of sending HTTP requests to the server to execute arbitrary Python code on the host machine. This constitutes an unrestricted remote code execution (RCE) vulnerability classified under CWE-94 (Improper Control of Generation of Code). The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity due to its network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. The issue was publicly disclosed on March 20, 2026, and fixed in mesop version 1.2.3. No known exploits have been reported in the wild yet. The flaw stems from the design choice to include a debugging endpoint that executes arbitrary code without safeguards, posing a severe risk if exposed in production environments.

This vulnerability allows attackers to gain full control over affected systems running vulnerable mesop versions by executing arbitrary Python code remotely without authentication. The impact includes complete compromise of confidentiality, integrity, and availability of the host system. Attackers can steal sensitive data, modify or delete files, install malware or backdoors, pivot within internal networks, and disrupt services. Given mesop's role as a UI framework for web applications, exploitation could lead to compromise of web-facing servers, potentially exposing customer data or internal resources. The ease of exploitation and lack of required privileges or user interaction make this a highly dangerous threat. Organizations using mesop in production environments are at significant risk of targeted attacks or automated exploitation once public details become widely known.

The primary mitigation is to upgrade all mesop instances to version 1.2.3 or later, where this vulnerability is fixed. Until upgrades can be applied, organizations should immediately restrict network access to the affected /exec-py endpoint, ideally by firewall rules or network segmentation, to prevent unauthorized HTTP requests. Disabling or removing the ai/testing module and the embedded Flask debugging server in production environments is strongly recommended to reduce attack surface. Monitoring and logging HTTP requests to detect suspicious activity targeting this endpoint can provide early warning of exploitation attempts. Additionally, running mesop with the least privilege possible and employing runtime application self-protection (RASP) or endpoint detection and response (EDR) solutions may help detect or block malicious code execution. Regular security audits and code reviews should be conducted to identify similar unsafe code execution patterns.