GHSL-2025-009: Arbitrary Code Execution in Mesa benchmarks.yml workflow - CVE-2026-29075
Published May 22, 2026
·Updated
Checking out of untrusted code in benchmarks.yml workflow may lead to code execution in privileged runner
Affected Software
1 affected component
Mesa Mesa
Event History
May 22, 2026
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
Description
Data Sourced
via GitHub Security Lab·12:00 AM
Affected Software
Frequently Asked Questions
1
Who is exposed to this issue?
The exposed component is the benchmarks.yml workflow when it checks out untrusted code on a privileged runner. Repositories using that workflow configuration are affected by this risk.
2
What does an attacker need to exploit it?
An attacker needs to cause untrusted code to be checked out by the benchmarks.yml workflow. If that code runs in the privileged runner context, it may result in arbitrary code execution.
3
What should be reviewed if patching cannot happen immediately?
Review the benchmarks.yml workflow for checkout of untrusted code and for jobs running on privileged runners. Prevent untrusted code from reaching privileged runner jobs until the workflow can be remediated.