Mesa: `benchmarks.yml` वर्कफ़्लो में अविश्वसनीय कोड की जाँच करने से विशेषाधिकार प्राप्त रनर में कोड निष्पादन हो सकता है

The vulnerability lies in Mesa's benchmarks.yml workflow, which automatically checks out code. An attacker could craft malicious code within this workflow, which, when executed by the privileged runner, would grant them control over the system. This could lead to data breaches, system compromise, and potentially, complete control of the environment where Mesa is deployed. The impact is particularly severe because agent-based modeling is often used in sensitive domains like financial modeling or scientific research, where data integrity and confidentiality are paramount. Successful exploitation could allow an attacker to inject malicious code into the simulation process, leading to inaccurate results or the theft of sensitive data.

Organizations and individuals utilizing Mesa for agent-based modeling, particularly those running simulations in environments with limited access controls or where the runner environment has elevated privileges. Researchers and developers who have customized the benchmarks.yml workflow are also at increased risk.

• python / supply-chain:

import os
import subprocess

# Check Mesa version
result = subprocess.run(['pip', 'show', 'mesa'], capture_output=True, text=True)
if result.returncode == 0:
    mesa_version = result.stdout.split('Version: ')[1].split('\n')[0]
    if float(mesa_version) <= 3.5:
        print("Mesa version is vulnerable.")
else:
    print("Mesa is not installed.")

• generic web: Check for unusual files or modifications within the Mesa installation directory, particularly related to the benchmarks.yml workflow.

1. 2026-03-06Disclosure

   disclosure

1. आरक्षित2026-03-03
2. प्रकाशित2026-03-06
3. संशोधित2026-03-09
4. EPSS अद्यतन2026-03-23

The primary mitigation is to upgrade to a patched version of Mesa. The fix is available in commit c35b8cd. If upgrading is not immediately feasible, consider temporarily disabling the benchmarks.yml workflow or restricting access to the runner environment. Review the benchmarks.yml file for any suspicious code or configurations. Implement strict code review processes for any custom benchmarks or extensions added to Mesa. After upgrading, confirm the fix by running the benchmarks.yml workflow with a known safe codebase and verifying that no unauthorized code execution occurs.