CVE-2026-33054 is a critical (CVSS 10.0) path traversal in Mesop, the Python UI framework, in versions 1.2.2 and earlier. An untrusted state token can point the file based session backend at arbitrary files on disk, causing crashes or file manipulation. Upgrade the mesop package to 1.2.3.
What's affected
The GitHub advisory lists the pip package mesop at versions up to and including 1.2.2, with 1.2.3 as the patched release. The record says systems that use FileStateSessionBackend, the disk based session backend, are the most exposed.
If your app keeps session state in memory or in another backend, read the advisory to confirm whether your setup is in scope before you rule it out.
How to check if you're exposed
Check the installed version in each environment:
pip show mesop
pip list | grep -i mesop
Then search your code and configuration for FileStateSessionBackend to see whether the disk backend is enabled. Look in lockfiles too, since Mesop may be pinned in a requirements.txt, poetry.lock or container image rather than installed by hand.
What to do now
- Upgrade to mesop 1.2.3 or later and redeploy.
- Rebuild container images so the old version does not linger in a cached layer.
- If you cannot upgrade yet, review whether the file based session backend is required and avoid exposing the app to untrusted users in the meantime.
- Check the session directory and the host for unexpected file changes or deleted files from before the upgrade.
Why it matters
The weakness class is CWE-22, path traversal. According to the advisory, the state token sent by the browser is used to build a file path under the session directory. Because the value is not checked, path operators in the token can walk out of that directory.
The record describes two outcomes: a denial of service through crash loops when the app reads a file that is not in the expected format, and arbitrary file manipulation, including overwriting or removing files. The CVSS vector shows network access, no privileges and no user interaction. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
You can also paste a lockfile into the free in-browser dependency scan to see whether Mesop is in your tree, including as a transitive dependency.
Quick check
Is the fix only a version bump?
The advisory names 1.2.3 as the patched version and the NVD record says the issue is fixed there. Upgrade, then confirm with pip show mesop.
Does this affect apps that do not use the file session backend?
The record says the file based backend is the heavily exposed configuration. Check the advisory for your own backend before deciding the risk is zero.
Sources
Last reviewed: 19 October 2026.
