CVE-2026-93421 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
Attackers can inject ANSI escape sequences into logs via an unauthenticated endpoint, potentially misleading operators viewing terminal output.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-93421?
CVE-2026-93421 is a medium-severity vulnerability in mesop-dev mesop, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.
Which versions are affected by CVE-2026-93421?
3 open source packages ship an affected version, including mesop.
| Package | Affected | Fixed in |
|---|---|---|
mesop PyPI | All versions | 1.3.4 |
mesop PyPI | All versions | 1.3.4 |
mesop PyPI | All versions | 1.3.4 |
How do I fix CVE-2026-93421?
Upgrade mesop to 1.3.4 or later.
Is CVE-2026-93421 being exploited?
There is no known exploitation of CVE-2026-93421 in the wild and no public exploit code.
Sources
Also known as GHSA-g7f6-rxc4-qhph, PYSEC-2026-4105.