Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-93421

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

CVSS 4.0 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-93421

Published

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-93421

Published

mesop

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "mesop-dev",
                    "product": "mesop",
                    "versions": [
                        {
                            "version": "< 1.3.4",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON