Vulnerability in Mesop UI Framework Allows Log Injection via Unauthenticated Endpoint

CVE-2026-93421

What is CVE-2026-93421?

The Mesop UI framework prior to version 1.3.4 contains a vulnerability in its unauthenticated /csp endpoint, which allows attacker-controlled values to be passed to the csp_report handler without proper sanitization. This can lead to log injection, where malicious ANSI or VT100 sequences can manipulate terminal display output, potentially hiding important information or showing falsified messages. Such actions could significantly undermine the integrity of monitoring systems and incident-response efforts.

References