How severe is CVE-2026-93421?

CVE-2026-93421 has a CVSS 4.0 base score of 5.3, rated medium severity.

Is CVE-2026-93421 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-93421?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-93421 published?

CVE-2026-93421 was published on 2026-09-23 and last updated on 2026-09-30.

CVE-2026-93421

CVE-2026-93421 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-117.

Key facts

Severity: Medium (CVSS 4.0 base score 5.3)
EPSS exploit prediction: 0% (32nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-117
Published: 2026-09-23
Last modified: 2026-09-30

Description

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.

Frequently asked questions

What is CVE-2026-93421?: Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.
How severe is CVE-2026-93421?: CVE-2026-93421 has a CVSS 4.0 base score of 5.3, rated medium severity.
Is CVE-2026-93421 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-93421?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-93421 published?: CVE-2026-93421 was published on 2026-09-23 and last updated on 2026-09-30.

References

Other CWE-117 (Improper Output Neutralization for Logs) vulnerabilities

CVE-2023-46322 — Critical (CVSS 9.8): iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial…
CVE-2023-46321 — Critical (CVSS 9.8): iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell…
CVE-2024-0095 — Critical (CVSS 9.0): NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where a user can inject forged logs and…
CVE-2026-17481 — High (CVSS 8.8): IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper…
CVE-2024-25047 — High (CVSS 8.6): IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application…
CVE-2025-57564 — High (CVSS 8.2): CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems…

Browse all CWE-117 (Improper Output Neutralization for Logs) vulnerabilities →