{"cve":"CVE-2024-45601","nvd":{"published":"2024-09-18T18:15:06.473","modified":"2026-06-17T07:54:32.897","status":"Deferred","description":"Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validation in a specific endpoint. This could have allowed an attacker to access files not intended to be served. Users are strongly advised to update to the latest version of Mesop immediately. The latest version includes a fix for this vulnerability. At time of publication 0.12.4 is the most recently available version of Mesop.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-20","CWE-22"],"references":["https://github.com/google/mesop/commit/17fb769d6a91f0a8cbccfab18f64977b158a6a31","https://github.com/google/mesop/security/advisories/GHSA-pmv9-3xqp-8w42"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:54:38.012257375+00:00"},"epss":{"cve":"CVE-2024-45601","score":0.0028,"percentile":0.20514,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-pmv9-3xqp-8w42","url":"https://osv.dev/vulnerability/GHSA-pmv9-3xqp-8w42","summary":"Mesop has a local file Inclusion via static file serving functionality","modified":"2026-07-07T17:57:18.406030243Z","packages":[{"ecosystem":"PyPI","name":"mesop","purl":"pkg:pypi/mesop","ranges":[">=0.9.0 <0.12.4"],"fixed":["0.12.4"]}]},{"id":"PYSEC-2026-1625","url":"https://osv.dev/vulnerability/PYSEC-2026-1625","summary":"Mesop has a local file Inclusion via static file serving functionality","modified":"2026-07-07T17:47:04.424325879Z","packages":[{"ecosystem":"PyPI","name":"mesop","purl":"pkg:pypi/mesop","ranges":[">=0.9.0 <0.12.4"],"fixed":["0.12.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}