TI-2026-62971 Aliases CVE-2026-93421 GHSA-g7f6-rxc4-qhph

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

LOW 25CWE-117Published 2026-09-23 · Updated 2026-09-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00528 44th percentileScored 2026-11-07

Fix Fixed mesop (mesop-dev): 1.3.4mesop (PyPI): 1.3.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
mesop-dev	mesop	before 1.3.4	1.3.4	Patch available	CNA
—	mesop (PyPI)	before 1.3.4	1.3.4	Patch available	GHSA-g7f6-rxc4-qhph

mesop Vendormesop-dev Affected before 1.3.4 Fixed in 1.3.4 Patch available CNA
mesop (PyPI) Vendor— Affected before 1.3.4 Fixed in 1.3.4 Patch available GHSA-g7f6-rxc4-qhph

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:mesop-dev:mesop::::::::	—	—	mesop-dev

cpe:2.3:a:mesop-dev:mesop:*:*:*:*:*:*:*:* Versions — — ·mesop-dev

Remediation

Fix · CNA mesop (mesop-dev) Fixed in 1.3.4
Fix · GHSA-g7f6-rxc4-qhph mesop (PyPI) Fixed in 1.3.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-93421
2026-10-03 Alias added: GHSA-g7f6-rxc4-qhph

References

Other 5

TI-2026-25500 Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py CVSS 3.1CRITICAL 9.8
TI-2026-25497 Mesop: Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion CVSS 3.1CRITICAL 10.0
TI-2026-53977 Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server CVSS 4.0HIGH 8.7
TI-2026-27068 Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service CVSS 3.1HIGH 7.5
TI-2025-21664 Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences