CVE-2026-29075: RCE in Mesa Agent-Based Modeling Library

The vulnerability lies in Mesa's benchmarks.yml workflow, which automatically checks out code. An attacker could craft malicious code within this workflow, which, when executed by the privileged runner, would grant them control over the system. This could lead to data breaches, system compromise, and potentially, complete control of the environment where Mesa is deployed. The impact is particularly severe because agent-based modeling is often used in sensitive domains like financial modeling or scientific research, where data integrity and confidentiality are paramount. Successful exploitation could allow an attacker to inject malicious code into the simulation process, leading to inaccurate results or the theft of sensitive data.

1. Reserved2026-03-03
2. Published2026-03-06
3. Modified2026-03-09
4. EPSS updated2026-03-23

The primary mitigation is to upgrade to a patched version of Mesa. The fix is available in commit c35b8cd. If upgrading is not immediately feasible, consider temporarily disabling the benchmarks.yml workflow or restricting access to the runner environment. Review the benchmarks.yml file for any suspicious code or configurations. Implement strict code review processes for any custom benchmarks or extensions added to Mesa. After upgrading, confirm the fix by running the benchmarks.yml workflow with a known safe codebase and verifying that no unauthorized code execution occurs.