CVE-2026-93421: Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
The /__csp__ endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print() without escaping control characters.
A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in an ANSI-capable terminal, these sequences can manipulate the displayed output (e.g., clear the screen, hide text, or inject misleading messages), affecting the integrity of operator-facing logs.
References
- github.com/advisories/GHSA-g7f6-rxc4-qhph
- github.com/mesop-dev/mesop/commit/f38c42a1d3eba246941ef8d7f645072d53c58785
- github.com/mesop-dev/mesop/pull/1397
- github.com/mesop-dev/mesop/releases/tag/v1.3.4
- github.com/mesop-dev/mesop/security/advisories/GHSA-g7f6-rxc4-qhph
- nvd.nist.gov/vuln/detail/CVE-2026-93421
Code Behaviors & Features
Detect and mitigate CVE-2026-93421 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →