CVE-2026-93421: Google Mesop unauthenticated ANSI escape sequence injection in CSP reporting

CVE-2026-93421 · Severity: medium · CVSS 4 · Published 2026-09-23

Mesop is a Python framework for building web applications. The Content Security Policy (CSP) reporting endpoint in Mesop accepts unauthenticated requests and logs user-supplied data directly to the console without filtering. An attacker can send specially crafted requests containing terminal control codes that manipulate how log messages appear, potentially hiding security warnings or injecting fake messages that could mislead operators during incident investigation.

Technologies: mesop (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-93421 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-93421 being exploited in the wild.
How severe is CVE-2026-93421?
Medium severity, with a CVSS score of 4, published 23 September 2026.
Which products and versions are affected?
mesop (PyPI) <= 1.3.3, ECOSYSTEM:introduced=0,fixed=1.3.4.
Is there a fix for CVE-2026-93421?
Yes. mesop (PyPI): upgrade to 1.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93421 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-93421?
Check whether you run mesop (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mesop (PyPI): upgrade to 1.3.4 or later
    pip install "mesop>=1.3.4"

Technical details

The vulnerability is an unauthenticated ANSI escape sequence injection in Mesop's /__csp__ endpoint (mesop/server/static_file_serving.py). The endpoint accepts JSON POST requests and logs CSP report fields (document-uri, blocked-uri, violated-directive) directly to stdout via print() without sanitization. An attacker can send requests with ANSI/VT100 escape sequences embedded in report fields; when logs are viewed in a terminal, these sequences are interpreted as control codes to clear the screen, reposition cursors, hide text, or change colors. This allows forging log entries, overwriting previous output, or disguising security-relevant warnings. No authentication is required. The attack is network-accessible and requires no user interaction beyond an attacker sending a POST request to the public CSP endpoint.

Affected products

  • Google Mesop

Identifiers

  • CVE-2026-93421
  • GHSA-g7f6-rxc4-qhph
  • PYSEC-2026-4105

Timeline

  • 2026-09-23: disclosed
  • other: Tracked as CVE-2026-93421

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.