CVE-2024-45601

Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validation in a specific endpoint. This could have allowed an attacker to access files not intended to be served. Users are strongly advised to update to the latest version of Mesop immediately. The latest version includes a fix for this vulnerability. At time of publication 0.12.4 is the most recently available version of Mesop.

• CWE-20
• CWE-22

• https://github.com/google/mesop/commit/17fb769d6a91f0a8cbccfab18f64977b158a6a31
• https://github.com/google/mesop/security/advisories/GHSA-pmv9-3xqp-8w42

Published

Sep 18, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45596Directus is a real-time API and App dashboard for managing S…6.5
• CVE-2024-45597Pluto is a superset of Lua 5.4 with a focus on general-purpo…5.3
• CVE-2024-45598Cacti is an open source performance and fault management fra…4.9
• CVE-2024-45599Cursor is an artificial intelligence code editor. Prior to v…3.8
• CVE-2024-4560The Kognetiks Chatbot for WordPress plugin for WordPress is …9.8
• CVE-2024-45600Fields is a GLPI plugin that allows users to add custom fiel…7.7
• CVE-2024-45604Contao is an Open Source CMS. In affected versions authentic…4.3
• CVE-2024-45605Sentry is a developer-first error tracking and performance m…4.3
• CVE-2024-45606Sentry is a developer-first error tracking and performance m…4.3
• CVE-2024-45607whatsapp-api-js is a TypeScript server agnostic Whatsapp's O…5.3
• CVE-2024-45608GLPI is a free asset and IT management software package. An …8.8
• CVE-2024-45609GLPI is a Free Asset and IT Management Software package, Dat…6.1