CVE-2026-93421: Mesop Unauthenticated ANSI Escape Sequence Injection Vulnerability
Summary
CVE-2026-93421: Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint. Affects mesop versions < 1.3.4. Fixed in 1.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mesop is a Python package designed for serving web applications and handling content security policy (CSP) reporting. It provides endpoints for logging and monitoring security-related events. However, it has a vulnerability in its CSP reporting endpoint that allows unauthenticated users to inject ANSI escape sequences into logs, potentially compromising the integrity of the displayed output.
Vulnerability Detail
The vulnerability arises from the '/csp' endpoint, which accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print() without escaping control characters. A remote attacker can exploit this by including ANSI/VT100 escape sequences in fields like 'blocked-uri' or 'document-uri'. This can lead to manipulated log outputs in ANSI-capable terminals, allowing attackers to inject misleading messages, clear the screen, or hide important security logs. The lack of sanitization in the logging process poses significant risks to the integrity and reliability of operator-facing logs.
How To Fix
Latest published version: 1.3.7 as of 23 Oct 2026
pip install --upgrade "mesop==1.3.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.4
This is the first release that contains the fix.
pip install --upgrade "mesop==1.3.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing a logging filter that sanitizes or escapes ANSI escape sequences before they are printed to stdout. This can be done by modifying the logging configuration in your application to strip out any control characters from the log messages.
Conclusion
CVE-2026-93421 represents a significant security risk for applications using the Mesop package, allowing attackers to manipulate log outputs through ANSI escape sequences. It is crucial to update to the patched version 1.3.4 or implement workarounds to mitigate this vulnerability.
See every vulnerability recorded for mesop →
FAQ
CVE-2026-93421 is a vulnerability in the Mesop package that allows unauthenticated ANSI escape sequence injection through the CSP reporting endpoint.
An attacker can manipulate log outputs, inject misleading messages, and hide important security information, compromising the integrity of your application's logs.
Versions of Mesop up to and including 1.3.3 are affected. The vulnerability is fixed in version 1.3.4.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring any installation.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software, using just the Pipfile.lock to assess vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for mesop.
