GHSA-g7f6-rxc4-qhph: Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
mediumvulnerability
security
Summary
A bug in Mesop's CSP reporting endpoint (a service that logs Content Security Policy violations) allows unauthenticated attackers to send specially crafted requests containing ANSI escape sequences (special characters that control how text appears in terminals). When these sequences are logged and displayed in a terminal, they can manipulate the output to hide real security warnings, display fake messages, or mislead administrators reviewing logs.
Vulnerability Details
EPSS (30-day exploit probability)
EPSS: 0.0%
Patch Available
Yes
Disclosure Date
September 23, 2026
Classification
Attack Type
Other
Attack SophisticationTrivial
Impact (CIA+S)
integrity
AI Component TargetedAPI
Affected Vendors
Google
Affected Packages
mesop@<= 1.3.3 (fixed: 1.3.4)
Related Issues
Monthly digest — independent AI security research
Original source: https://github.com/advisories/GHSA-g7f6-rxc4-qhph
First tracked: September 23, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 85%