CVE-2026-93421

Name of the Vulnerable Software and Affected Versions Mesop versions prior to 1.3.4

Description The unauthenticated '/ csp ' endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp report() function in mesop/server/static file serving.py. These values are printed to standard output without neutralizing terminal control sequences. When an operator views the logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output.

Recommendations Update to version 1.3.4. As a temporary workaround, restrict access to the '/ csp ' endpoint to minimize the risk of exploitation.