Executive brief
Mesop is a Python framework for building web applications. The Content Security Policy (CSP) reporting endpoint in Mesop accepts unauthenticated requests and logs user-supplied data directly to the console without filtering. An attacker can send specially crafted requests containing terminal control codes that manipulate how log messages appear, potentially hiding security warnings or injecting fake messages that could mislead operators during incident investigation.
Technical details
The vulnerability is an unauthenticated ANSI escape sequence injection in Mesop's /__csp__ endpoint (mesop/server/static_file_serving.py). The endpoint accepts JSON POST requests and logs CSP report fields (document-uri, blocked-uri, violated-directive) directly to stdout via print() without sanitization. An attacker can send requests with ANSI/VT100 escape sequences embedded in report fields; when logs are viewed in a terminal, these sequences are interpreted as control codes to clear the screen, reposition cursors, hide text, or change colors. This allows forging log entries, overwriting previous output, or disguising security-relevant warnings. No authentication is required. The attack is network-accessible and requires no user interaction beyond an attacker sending a POST request to the public CSP endpoint.
Affected products
- Google Mesop
Timeline
- 2026-09-23: disclosed
- other: Tracked as CVE-2026-93421