CVE-2026-93421: Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

The /__csp__ endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print() without escaping control characters.

A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in an ANSI-capable terminal, these sequences can manipulate the displayed output (e.g., clear the screen, hide text, or inject misleading messages), affecting the integrity of operator-facing logs.