CVE-2026-93421: medium-severity vulnerability in mesop-dev mesop
Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
exploitation probability
0.4%top 67% of all CVEs
observed exploitation
nono source reports it
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Affected products
mesop-dev · mesopRelated CVEs — mesop-dev mesop
In the same product, most dangerous first.
CVE-2026-33057CRITICALMesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-pyEPSS 4.1%CVE-2025-30358HIGHMesop Class Pollution vulnerability leads to DoS and Jailbreak attacksEPSS 0.7%CVE-2026-33054CRITICALMesop: Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/DeletionEPSS 0.7%CVE-2026-34824HIGHMesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of ServiceEPSS 0.7%CVE-2026-77357HIGHMesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the serverEPSS 0.5%