CVE-2026-93421

Description

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: MEDIUM
CVSS score: 5.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Effective score: 5.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-117, CWE-150
Reserved: 2026-09-17
Published: 2026-09-23 18:59 UTC
Last updated: 2026-09-23 19:41 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93421.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-23 19:19:45 UTC
NVD last modified: 2026-09-23 20:17:22 UTC

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85568
Assigner: GitHub_M
Published: Sep 23, 2026, 6:59:52 PM
Updated: Sep 23, 2026, 7:41:34 PM
EUVD base score (CVSS 4.0): 5.3 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
EUVD-reported EPSS: 0.0000
Vendors: mesop-dev
Products: mesop (< 1.3.4)
Aliases: GHSA-g7f6-rxc4-qhph

ENISA description: Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.

EUVD references (4)

Affected products (1)

Vendor	Product	Versions	Platforms
mesop-dev	mesop	`< 1.3.4` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

https://github.com/mesop-dev/mesop/security/advisories/GHSA-g7f6-rxc4-qhph x_refsource_CONFIRM
https://github.com/mesop-dev/mesop/pull/1397 x_refsource_MISC
https://github.com/mesop-dev/mesop/commit/f38c42a1d3eba246941ef8d7f645072d53c58785 x_refsource_MISC
https://github.com/mesop-dev/mesop/releases/tag/v1.3.4 x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/mesop-dev/mesop/commit/f38c42a1d3eba246941ef8d7f645072d53c58785 security-advisories@github.com
https://github.com/mesop-dev/mesop/pull/1397 security-advisories@github.com
https://github.com/mesop-dev/mesop/releases/tag/v1.3.4 security-advisories@github.com
https://github.com/mesop-dev/mesop/security/advisories/GHSA-g7f6-rxc4-qhph security-advisories@github.com

Remediations (10)

CVE-2026-93421: Mesop Vulnerability (CVSS 5.3) | CVETodo

web:cvetodo.com

CVE-2026-93421 is a CVSS 5.3 medium-severity vulnerability in Mesop. Full technical analysis, mitigations , and exploit status — updated in real time.

2026-09-24 11:46 UTC
CVE-2026-93421 - Exploits & Severity - Feedly

web:feedly.com

Summary The /__csp__ endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout without escaping control characters. A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri that will be interpreted by ANSI-capable terminals when logs are viewed, allowing manipulation of displayed output.

2026-09-24 11:46 UTC
CVE-2026-59346: Critical VMware Workstation & Fusion VM Escape ...

web:securityarsenal.com

A CVSS 9.3 integer overflow in VMware Workstation and Fusion lets a privileged guest user execute code on the host. Patch now and hunt for VM escape indicators.

2026-09-24 11:46 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-24 11:46 UTC
Windows Zero-Day Patch Tuesday: 421 CVEs Fixed [2026]

web:tech-insider.org

August 2026 Patch Tuesday fixed 421 CVEs , 62 critical, and 4 zero-days. CISA issued an emergency alert for actively exploited Windows, VMware, Cisco bugs.

2026-09-24 11:46 UTC
CVE-2026-93421 - Detail CVSS, EPSS & CISA Kev | CVE Find

web:www.cvefind.com

Full details for CVE-2026-93421 : technical description, impact, CVSS/EPSS scores, linked CWE, CAPEC, affected CPEs, disclosure date, and mitigation options.

2026-09-24 11:46 UTC
September 2026 Oracle Critical Security Patch Update Analysis

web:www.fortra.com

Analyze Oracle's September 2026 Critical Security Patch Update, including 673 patches, 246 remotely exploitable CVEs , and key vulnerabilities with CVSS scores up to 10.0.

2026-09-24 11:46 UTC
CISA KEV Vulnerabilities Added September 2, 2026 | SecPod

web:www.secpod.com

Patch Analysis & Exploitation Timeline: Seven CVEs , Two Remediation Tracks, CISA's September 2, 2026 KEV Additions An analysis of seven vulnerabilities added to the CISA Known Exploited Vulnerabilities catalog on September 2, 2026 , covering vulnerability types, remediation deadlines, and patch prioritization considerations.

2026-09-24 11:46 UTC
CVE Vulnerabilities from 2026 — Full List - Strix

web:www.strix.ai

Complete list of CVE vulnerabilities from 2026 with severity scores and exploit data.

2026-09-24 11:46 UTC
CISA KEV Catalog Expands: Four Critical Exploits Demand Action

web:www.vicisecurity.com

CISA added four actively exploited vulnerabilities to its KEV catalog. Learn what Microsoft, VMware, and Apple flaws mean for your compliance obligations.

2026-09-24 11:46 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-93421.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93421",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:25:37.624256Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:41:34.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mesop",
          "vendor": "mesop-dev",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:59:52.637Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-g7f6-rxc4-qhph",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-g7f6-rxc4-qhph"
        },
        {
          "name": "https://github.com/mesop-dev/mesop/pull/1397",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mesop-dev/mesop/pull/1397"
        },
        {
          "name": "https://github.com/mesop-dev/mesop/commit/f38c42a1d3eba246941ef8d7f645072d53c58785",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mesop-dev/mesop/commit/f38c42a1d3eba246941ef8d7f645072d53c58785"
        },
        {
          "name": "https://github.com/mesop-dev/mesop/releases/tag/v1.3.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mesop-dev/mesop/releases/tag/v1.3.4"
        }
      ],
      "source": {
        "advisory": "GHSA-g7f6-rxc4-qhph",
        "discovery": "UNKNOWN"
      },
      "title": "Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-93421",
    "datePublished": "2026-09-23T18:59:52.637Z",
    "dateReserved": "2026-09-17T20:57:18.984Z",
    "dateUpdated": "2026-09-23T19:41:34.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}