GHSA-V853-P72Q-4CFW
Vulnerability from github – Published: 2026-10-05 22:49 – Updated: 2026-10-05 22:49Summary
Quart 0.23.0 contains a stray debug statement (print(data)) inside Body.__await__ in quart/wrappers/request.py. Any request whose body is awaited — await request.form, await request.get_data(), WTForms validate_on_submit(), etc. — has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0.
Details
In src/quart/wrappers/request.py, Body.__await__ accumulates the request body into a bytearray:
python
data = bytearray()
while not self._queue.empty():
data.extend(self._queue.get_nowait())
print(data) # <-- not present in 0.22.0
if (
self._max_content_length is not None
and len(data) > self._max_content_length
):
raise RequestEntityTooLarge()
This fires for every request that awaits its body — the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via request.get_json(), file uploads, etc.).
PoC
pip install quart==0.23.0(requires Python 3.13+)- Minimal route:
python @app.route("/login", methods=["POST"]) async def login(): form_data = await request.form ... - Submit a POST with form data, e.g. a login form with
staff_id/passwordfields. - Observe stdout: the full raw body is printed as
bytearray(b'csrf_token=...&staff_id=...&password=...').
Confirmed via source diff against 0.22.0's request.py, where this line does not exist.
Impact
Any app that captures stdout in logs (terminal redirect, systemd/journald, Docker logs, cloud log aggregation, etc.) will have every submitted form body — including login credentials — written to logs in plaintext. This affects any Quart 0.23.0 app handling authentication or any sensitive form data, and is trivially triggerable by any user simply submitting a form (no attacker action required beyond normal use).
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "quart"
},
"ranges": [
{
"events": [
{
"introduced": "0.23.0"
},
{
"fixed": "0.23.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.23.0"
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-05T22:49:44Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nQuart 0.23.0 contains a stray debug statement (`print(data)`) inside `Body.__await__` in `quart/wrappers/request.py`. Any request whose body is awaited \u2014 `await request.form`, `await request.get_data()`, WTForms `validate_on_submit()`, etc. \u2014 has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0.\n\n### Details\nIn `src/quart/wrappers/request.py`, `Body.__await__` accumulates the request body into a bytearray:\n\n\u200b```python\ndata = bytearray()\nwhile not self._queue.empty():\n data.extend(self._queue.get_nowait())\n print(data) # \u003c-- not present in 0.22.0\n if (\n self._max_content_length is not None\n and len(data) \u003e self._max_content_length\n ):\n raise RequestEntityTooLarge()\n\u200b```\n\nThis fires for every request that awaits its body \u2014 the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via `request.get_json()`, file uploads, etc.).\n\n### PoC\n1. `pip install quart==0.23.0` (requires Python 3.13+)\n2. Minimal route:\n\u200b```python\n@app.route(\"/login\", methods=[\"POST\"])\nasync def login():\n form_data = await request.form\n ...\n\u200b```\n3. Submit a POST with form data, e.g. a login form with `staff_id`/`password` fields.\n4. Observe stdout: the full raw body is printed as `bytearray(b\u0027csrf_token=...\u0026staff_id=...\u0026password=...\u0027)`.\n\nConfirmed via source diff against 0.22.0\u0027s `request.py`, where this line does not exist.\n\n### Impact\nAny app that captures stdout in logs (terminal redirect, systemd/journald, Docker logs, cloud log aggregation, etc.) will have every submitted form body \u2014 including login credentials \u2014 written to logs in plaintext. This affects any Quart 0.23.0 app handling authentication or any sensitive form data, and is trivially triggerable by any user simply submitting a form (no attacker action required beyond normal use).",
"id": "GHSA-v853-p72q-4cfw",
"modified": "2026-10-05T22:49:44Z",
"published": "2026-10-05T22:49:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pallets/quart/security/advisories/GHSA-v853-p72q-4cfw"
},
{
"type": "WEB",
"url": "https://github.com/pallets/quart/commit/e8eb3b8a0cb98e7574bf3841312fc7f96883d055"
},
{
"type": "PACKAGE",
"url": "https://github.com/pallets/quart"
},
{
"type": "WEB",
"url": "https://github.com/pallets/quart/releases/tag/0.23.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.