Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.

Affected: PyPI: mesop

### Summary

The `/__csp__` endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using `print()` without escaping control characters.

A remote attacker can include ANSI/VT100 escape sequences in fields such as `blocked-uri` or `document-uri`. When the logs are viewed in an ANSI-capable terminal, these sequences can manipulate the displayed output (e.g., clear the screen, hide text, or inject misleading messages), affecting the integrity of operator-facing logs.

### Details

The CSP reporting endpoint accepts arbitrary JSON and prints several request fields directly:

mesop/server/static_file_serving.py ```python @app.route(prefix_base_url("/__csp__"), methods=["POST"]) def csp_report(): report = request.get_json(force=True)

document_uri = report["csp-report"]["document-uri"] blocked_uri = report["csp-report"]["blocked-uri"] violated_directive = report["csp-report"]["violated-directive"]

print(f"... Blocked URL: {blocked_uri} ...") ```

Since these values are written to stdout without sanitization, ANSI escape sequences supplied by a remote client are preserved and interpreted by ANSI-compatible terminals.

### PoC

Send the following request:

```http POST /__csp__ Content-Type: application/json

{ "csp-report": { "document-uri": "https://victim.example", "blocked-uri": "\u001b[2J\u001b[H\u001b[32m*** SECURITY OK - No CSP violations found ***\u001b[0m\n\u001b[8mhttps://evil.example", "violated-…

Affected: PyPI: mesop

### Summary

The `/__csp__` endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using `print()` without escaping control characters.

A remote attacker can include ANSI/VT100 escape sequences in fields such as `blocked-uri` or `document-uri`. When the logs are viewed in an ANSI-capable terminal, these sequences can manipulate the displayed output (e.g., clear the screen, hide text, or inject misleading messages), affecting the integrity of operator-facing logs.

### Details

The CSP reporting endpoint accepts arbitrary JSON and prints several request fields directly:

mesop/server/static_file_serving.py ```python @app.route(prefix_base_url("/__csp__"), methods=["POST"]) def csp_report(): report = request.get_json(force=True)

document_uri = report["csp-report"]["document-uri"] blocked_uri = report["csp-report"]["blocked-uri"] violated_directive = report["csp-report"]["violated-directive"]

print(f"... Blocked URL: {blocked_uri} ...") ```

Since these values are written to stdout without sanitization, ANSI escape sequences supplied by a remote client are preserved and interpreted by ANSI-compatible terminals.

### PoC

Send the following request:

```http POST /__csp__ Content-Type: application/json

{ "csp-report": { "document-uri": "https://victim.example", "blocked-uri": "\u001b[2J\u001b[H\u001b[32m*** SECURITY OK - No CSP violations found ***\u001b[0m\n\u001b[8mhttps://evil.example", "violated-…