Mesop, a Python UI framework, allowed unauthenticated access to the /__csp__ endpoint in versions before 1.3.4. The endpoint forwarded attacker‑controlled document‑uri, blocked‑uri, and violated‑directive values to the csp_report handler without neutralizing terminal control characters. This behavior exploits CWE‑117 and CWE‑150, allowing the printed values to contain ANSI or VT‑100 escape sequences. When these values are written to standard output, an operator examining the logs in an ANSI‑capable terminal could inject escape sequences that clear, reposition, or hide portions of the display or insert forged messages, thereby compromising the integrity of monitoring and incident‑response information.

The affected product is Mesop by mesop-dev. All releases prior to 1.3.4 are vulnerable; version 1.3.4 and later contain the fix.

The CVSS score is 5.3, indicating a medium impact. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the unauthenticated endpoint to inject ANSI or VT‑100 sequences that manipulate log presentation for anyone viewing the logs on a terminal. This does not grant code execution but can mislead operators, obscure indicators of compromise, and undermine forensic accuracy.