CVE-2026-29075 affects Mesa, an open-source Python library for agent-based modeling. The vulnerability exists in version 3.5.0 and prior, where untrusted code checkout in the benchmarks.yml workflow can lead to code execution in privileged runners. This represents a supply chain attack vector through CI/CD pipeline exploitation. The issue has been patched via commit c35b8cd. The vulnerability allows attackers to potentially execute malicious code within the project's automated testing environment.