CVE-2024-45601 json
Local file Inclusion via static file serving functionality in Mesop
published 2y ago modified 4mo ago also GHSA-pmv9-3xqp-8w42 , PYSEC-2026-1625 , EUVD-2024-2845
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validation in a specific endpoint. This could have allowed an attacker to access files not intended to be served. Users are strongly advised to update to the latest version of Mesop immediately. The latest version includes a fix for this vulnerability. At time of publication 0.12.4 is the most recently available version of Mesop.
Patch / fix
Is CVE-2024-45601 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mesop | >=0.9.0, <0.12.4 |
0.12.4 |
Affected products
- google mesop
Classification
References
-
github.com
/google/mesop/commit/17fb769d6a91f0a8cbccfab18f64977b158a6a31
web
-
github.com
/google/mesop/security/advisories/GHSA-pmv9-3xqp-8w42
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-45601
advisory
-
github.com
/google/mesop
package
-
pypi.org
/project/mesop
package
-
github.com
/advisories/GHSA-pmv9-3xqp-8w42
advisory
Sources
- CVE List CVE-2024-45601
- GitHub Advisory GHSA-pmv9-3xqp-8w42
- NVD CVE-2024-45601
- OSV PYSEC-2026-1625
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.