CVE-2026-93421
Received Received - Intake

Mesop Framework Terminal Control Sequence Injection

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-93421
EUVD
EUVD-2026-85568

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mesop mesop 1.3.4
mesop mesop From 1.3.4 (inc)
mesop mesop to 1.3.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-117 The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
CWE-150 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an ANSI escape sequence injection in the Mesop framework's CSP reporting endpoint. Prior to version 1.3.4, the unauthenticated /__csp__ endpoint logs attacker-controlled values like document-uri, blocked-uri, and violated-directive directly to standard output without sanitization. When viewed in an ANSI-capable terminal, malicious sequences can manipulate display, hide text, or forge messages, compromising log integrity.

Detection Guidance

Check Mesop server logs for suspicious ANSI escape sequences in CSP report fields. Look for entries in /__csp__ endpoint logs containing control characters like [31m, [0m, or other VT100 sequences. Use grep to search logs: grep -E '(\[[0-9;]+m|\x1b\[)' /var/log/mesop.log or similar paths.

Impact Analysis

An attacker could inject terminal control sequences into CSP reports, causing forged log messages, screen manipulation, hidden text, or misleading notifications. This reduces the reliability of monitoring and incident-response logs, potentially hiding real security events or presenting fake ones.

Compliance Impact

This vulnerability could impact compliance by compromising the integrity of logs used for auditing or monitoring. For GDPR, it may affect data integrity requirements (Article 5). For HIPAA, it could undermine audit controls (45 CFR § 164.312(b)). Log manipulation risks non-compliance with logging integrity standards.

Mitigation Strategies

Upgrade Mesop to version 1.3.4 or later. If upgrading is not immediately possible, disable the /__csp__ endpoint or implement input sanitization for CSP report fields to remove ANSI escape sequences before logging.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93421. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart