CVE-2026-29075: 
NixOS vulnerability analysis and mitigation

CVE-2026-29075 is a code injection vulnerability in the Mesa Python library (an open-source agent-based modeling framework) affecting version 3.5.0 and prior. The vulnerability exists in the benchmarks.yml GitHub Actions workflow, where untrusted code from pull request branches is checked out and executed in a privileged runner context. It was published on March 6, 2026, and patched via commit c35b8cd. The CVSS v3.1 base score is 9.8 (Critical) per NVD/Feedly estimates, while the GitHub Security Advisory assigns a score of 8.3 (High) with a scope-changed vector (GitHub Advisory, Feedly).

The root cause is improper control of code generation (CWE-94) within the benchmarks.yml GitHub Actions workflow, which was configured to trigger on pull_request_target — a high-privilege event that grants write access to issues and pull requests. The workflow checked out code from the PR contributor's branch and then executed it directly via pip install and a Python script (benchmarks/global_benchmark.py), without any sandboxing or validation. A malicious contributor could craft a setup.py or benchmarks/global_benchmark.py in their PR branch to execute arbitrary code in the privileged runner environment. This class of vulnerability is well-documented in CI/CD security research as a pull_request_target misuse pattern (GitHub Advisory, GitHub Commit).

Successful exploitation allows an attacker to execute arbitrary code within the GitHub Actions runner that holds write privileges to the Mesa repository's issues and pull requests. This enables theft of repository secrets and CI/CD credentials, unauthorized modification of repository content, compromise of the CI/CD pipeline, and potential supply chain attacks against downstream users of the Mesa library. The vulnerability requires no privileges or user interaction, making it exploitable by any external contributor who can submit a pull request (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.067%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify the Mesa Python library repository on GitHub and confirm it uses a benchmarks.yml workflow triggered by pull_request_target on a vulnerable version (≤ 3.5.0).
2. Fork the repository: Create a fork of the mesa/mesa repository under an attacker-controlled GitHub account.
3. Craft malicious payload: In the forked branch, modify setup.py or create/modify benchmarks/global_benchmark.py to include arbitrary code (e.g., exfiltrating environment variables containing secrets, or establishing a reverse shell).
4. Submit a pull request: Open a pull request from the malicious fork branch targeting the main Mesa repository. This triggers the benchmarks.yml workflow under the pull_request_target event.
5. Code execution in privileged runner: The workflow checks out the attacker's branch and executes pip install (invoking the malicious setup.py) or runs global_benchmark.py directly, achieving arbitrary code execution in the runner with write privileges to issues and pull requests.
6. Exfiltrate secrets or pivot: Use the runner's environment to access GITHUB_TOKEN and other secrets, modify repository content, or inject malicious code into the project (GitHub Advisory, GitHub Commit).

• CI/CD Logs: GitHub Actions workflow logs showing unexpected network connections, environment variable dumps, or unusual subprocess executions originating from the benchmarks.yml workflow run.
• Repository Activity: Pull requests from unknown or newly created accounts that modify setup.py, benchmarks/global_benchmark.py, or .github/workflows/benchmarks.yml.
• Secrets Exposure: Unexpected use of GITHUB_TOKEN or repository secrets outside of normal workflow steps; alerts from GitHub's secret scanning for exposed tokens.
• Network: Outbound connections from the GitHub Actions runner to external IPs or domains not associated with legitimate benchmark dependencies during a benchmarks.yml workflow run.
• File System (Runner): Unexpected files written to the runner's workspace, particularly scripts or binaries not part of the Mesa codebase.

The vulnerability is patched in Mesa versions after 3.5.0 via commit c35b8cd, which splits the benchmarks.yml workflow into two separate workflows: a low-privilege workflow triggered by pull_request (instead of pull_request_target) with read-only permissions for running benchmarks, and a second privileged workflow triggered by workflow_run for posting PR comments. Users should upgrade to Mesa > 3.5.0 immediately. As a temporary workaround, restrict write permissions on the benchmarks workflow, disable automatic workflow execution for untrusted pull requests, implement mandatory code review for workflow file changes, and monitor CI/CD logs for suspicious activity (GitHub Advisory, GitHub Commit).

The vulnerability was reported by the GitHub Security Lab (GHSL-2025-009) and disclosed by Mesa maintainer jackiekazil on March 5–6, 2026. Social media activity was observed on Mastodon and Bluesky shortly after disclosure, with community members noting the CI/CD supply chain risk. Red Hat tracked the CVE in their security advisory database. No major media coverage or significant vendor statements beyond the GitHub advisory have been identified (GitHub Advisory, Red Hat CVE).