# CVE-2026-93421: Google Mesop unauthenticated ANSI escape sequence injection in CSP reporting

Source: https://junglewise.ai/threats/cve-2026-93421-google-mesop-unauthenticated-ansi-escape-sequence-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-93421 · Severity: medium · CVSS 4 · Published 2026-09-23

Mesop is a Python framework for building web applications. The Content Security Policy (CSP) reporting endpoint in Mesop accepts unauthenticated requests and logs user-supplied data directly to the console without filtering. An attacker can send specially crafted requests containing terminal control codes that manipulate how log messages appear, potentially hiding security warnings or injecting fake messages that could mislead operators during incident investigation.

Technologies: [mesop (PyPI)](https://junglewise.ai/threats/technologies/mesop). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-93421 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93421 being exploited in the wild.

**How severe is CVE-2026-93421?** Medium severity, with a CVSS score of 4, published 23 September 2026.

**Which products and versions are affected?** mesop (PyPI) <= 1.3.3, ECOSYSTEM:introduced=0,fixed=1.3.4.

**Is there a fix for CVE-2026-93421?** Yes. mesop (PyPI): upgrade to 1.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93421 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-93421?** Check whether you run mesop (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mesop (PyPI): upgrade to 1.3.4 or later

  ```sh
  pip install "mesop>=1.3.4"
  ```


## Technical details

The vulnerability is an unauthenticated ANSI escape sequence injection in Mesop's /__csp__ endpoint (mesop/server/static_file_serving.py). The endpoint accepts JSON POST requests and logs CSP report fields (document-uri, blocked-uri, violated-directive) directly to stdout via print() without sanitization. An attacker can send requests with ANSI/VT100 escape sequences embedded in report fields; when logs are viewed in a terminal, these sequences are interpreted as control codes to clear the screen, reposition cursors, hide text, or change colors. This allows forging log entries, overwriting previous output, or disguising security-relevant warnings. No authentication is required. The attack is network-accessible and requires no user interaction beyond an attacker sending a POST request to the public CSP endpoint.

## Affected products

- Google Mesop

## Identifiers

- CVE-2026-93421
- GHSA-g7f6-rxc4-qhph
- PYSEC-2026-4105

## Timeline

- 2026-09-23: disclosed
- other: Tracked as CVE-2026-93421

## Related threats

- [PYSEC-2026-1624 - Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks](https://junglewise.ai/threats/cve-2025-30358-mesop-class-pollution-vulnerability-leads-to-dos-and-jailbreak)
- [PYSEC-2026-1625 - Mesop has a local file Inclusion via static file serving functionality](https://junglewise.ai/threats/cve-2024-45601-mesop-has-a-local-file-inclusion-via-static-file-serving)
- [PYSEC-2026-412 - Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py](https://junglewise.ai/threats/cve-2026-33057-mesop-affected-by-unauthenticated-remote-code-execution-via-test)
- [Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion](https://junglewise.ai/threats/cve-2026-33054-mesop-has-a-path-traversal-utilizing-filestatesessionbackend)
- [mesop-dev Mesop uncontrolled resource consumption in WebSocket handler](https://junglewise.ai/threats/cve-2026-34824-mesop-dev-mesop-uncontrolled-resource-consumption-in-websocket)