CVE-2026-93421: CWE-117: Improper Output Neutralization for Logs in mesop-dev mesop
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.
AI Analysis
Technical Summary
Mesop versions before 1.3.4 have an improper output neutralization vulnerability (CWE-117) in the /__csp__ endpoint. Attacker-controlled parameters document-uri, blocked-uri, and violated-directive are passed to the csp_report handler and printed to standard output without sanitization of terminal control sequences. This can lead to log injection attacks where ANSI or VT100 sequences alter terminal display, undermining log integrity and operator monitoring. The vulnerability is addressed in mesop version 1.3.4.
Potential Impact
An unauthenticated attacker can inject terminal control sequences into logs via the /__csp__ endpoint, causing log display manipulation such as clearing, repositioning, hiding text, or forging messages. This reduces the reliability and integrity of monitoring and incident response processes that rely on these logs. There is no indication of direct code execution or data compromise beyond log integrity.
Mitigation Recommendations
Upgrade mesop to version 1.3.4 or later, where this vulnerability is fixed by properly neutralizing terminal control sequences in log output. No other mitigation is required as the fix is official and available.
CVE-2026-93421: CWE-117: Improper Output Neutralization for Logs in mesop-dev mesop
Description
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.
CVSS v4.0
Score 5.3medium
Affected software
mesop-dev
mesop
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Mesop versions before 1.3.4 have an improper output neutralization vulnerability (CWE-117) in the /__csp__ endpoint. Attacker-controlled parameters document-uri, blocked-uri, and violated-directive are passed to the csp_report handler and printed to standard output without sanitization of terminal control sequences. This can lead to log injection attacks where ANSI or VT100 sequences alter terminal display, undermining log integrity and operator monitoring. The vulnerability is addressed in mesop version 1.3.4.
Potential Impact
An unauthenticated attacker can inject terminal control sequences into logs via the /__csp__ endpoint, causing log display manipulation such as clearing, repositioning, hiding text, or forging messages. This reduces the reliability and integrity of monitoring and incident response processes that rely on these logs. There is no indication of direct code execution or data compromise beyond log integrity.
Mitigation Recommendations
Upgrade mesop to version 1.3.4 or later, where this vulnerability is fixed by properly neutralizing terminal control sequences in log output. No other mitigation is required as the fix is official and available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-17T20:57:18.984Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab42272f7a7c5410633c3af
Added to database: 09/23/2026, 19:03:14 UTC
Last enriched: 09/23/2026, 19:18:39 UTC
Last updated: 09/24/2026, 01:57:04 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.