Mesop AI Sandbox <= 1.2.2 - Remote Code Execution

Mesop = 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server. id:...

CVE-2026-33057---Mesop-Unauthenticated-RCE-PoC-and-yara-rules

CVE-2026-33057---Mesop-Unauthenticated-RCE-PoC-and-yara-rules CVE-2026-33057 - Mesop 未認証RCE PoCおよびyaraルール 現実的に言うと、動作するかどうかは確信が持てません。おそらく動作しないでしょうが、とにかく試してみてください… BİOと寄付先: https://guns.lol/hackpatato cveプロフィール: https://socradar.io/free-tools/cve-radar/CVE-2026-33057 および...

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

SummaryThe /csp endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print without escaping control characters.A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in an...

VulnCheck KEV: CVE-2026-33057

Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 and below, an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings unconditionally without authentication measures, yielding standard...

CVE-2026-93421

creationtimestamp| type| source ---|---|--- 2026-09-23 20:35:07+00:00| published-proof-of-concept| https://github.com/mesop-dev/mesop/security/advisories/GHSA-g7f6-rxc4-qhph...

CVE-2026-93421

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

GHSA-G7F6-RXC4-QHPH Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Summary The /csp endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print without escaping control characters. A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in a...

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Summary The /csp endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print without escaping control characters. A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in a...

CVE-2026-93421 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

EUVD-2026-85568

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

CVE-2026-93421 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

CVE-2026-93421

The Mesop Python-based UI framework is vulnerable to an unauthenticated ANSI escape sequence injection in the /__csp__ endpoint. The csp_report handler in mesop/server/static_file_serving.py processes attacker-controlled JSON fields (such as blocked-uri and document-uri) and prints them directly ...

CVE-2026-93421 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

PT-2026-97531

Name of the Vulnerable Software and Affected Versions Mesop versions prior to 1.3.4 Description The unauthenticated '/ csp ' endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp report function in mesop/server/static file serving.py. These values...

CVE-2026-93421: Improper Output Neutralization for Logs

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

Exploit for Code Injection in Mesop-Dev Mesop

CVE-2026-33057---Mesop-Unauthenticated-RCE-PoC-and-yara-rules...

CVE-2026-77357

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...

CVE-2026-77357 Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...

EUVD-2026-66114

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...

CVE-2026-77357 Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...