{"id":"GHSA-v853-p72q-4cfw","kind":"vulnerability","aliases":["GHSA-v853-p72q-4cfw"],"related":[],"title":"Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__","description":"### Summary\nQuart 0.23.0 contains a stray debug statement (`print(data)`) inside `Body.__await__` in `quart/wrappers/request.py`. Any request whose body is awaited — `await request.form`, `await request.get_data()`, WTForms `validate_on_submit()`, etc. — has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0.\n\n### Details\nIn `src/quart/wrappers/request.py`, `Body.__await__` accumulates the request body into a bytearray:\n\n​```python\ndata = bytearray()\nwhile not self._queue.empty():\n    data.extend(self._queue.get_nowait())\n    print(data)          # <-- not present in 0.22.0\n    if (\n        self._max_content_length is not None\n        and len(data) > self._max_content_length\n    ):\n        raise RequestEntityTooLarge()\n​```\n\nThis fires for every request that awaits its body — the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via `request.get_json()`, file uploads, etc.).\n\n### PoC\n1. `pip install quart==0.23.0` (requires Python 3.13+)\n2. Minimal route:\n​```python\n@app.route(\"/login\", methods=[\"POST\"])\nasync def login():\n    form_data = await request.form\n    ...\n​```\n3. Submit a POST with form data, e.g. a login form with `staff_id`/`password` fields.\n4. Observe stdout: the full raw body is printed as `bytearray(b'csrf_token=...&staff_id=...&password=...')`.\n\nConfirmed via source diff against 0.22.0's `request.py`, where this line does not exist.\n\n### Impact\nAny app that captures stdout in logs (terminal redirect, systemd/journald, Docker logs, cloud log aggregation, etc.) will have every submitted form body — including login credentials — written to logs in plaintext. This affects any Quart 0.23.0 app handling authentication or any sensitive form data, and is trivially triggerable by any user simply submitting a form (no attacker action required beyond normal use).","summary":"Quart 0.23.0 has a leftover debug print in its request body handling, so every awaited request body is written to standard output. Anyone who can read the app's logs can see submitted form fields such as passwords and CSRF tokens.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"quart","fixed":["0.23.1"],"affected":"= 0.23.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-532","flask-like-apps","package","python","quart","wtforms"],"not_affected_if":["version-0.22.0","version-0.23.1-or-later"],"how_to_check":"- Check the installed version with `pip show quart` or `pip freeze | grep -i quart`; `0.23.0` is affected.\n- Search the app's stdout and log sinks (journald, Docker logs, cloud log aggregation) for `bytearray(b'` strings that contain form field names.","fix":"- Quart `0.23.1` (fixed version per the advisory; `0.23.0` is affected)","status":"open","published_at":"2026-10-05T22:49:44+00:00","first_seen_at":"2026-11-02T13:44:17+00:00","triaged_at":"2026-11-02T13:45:21+00:00","updated_at":"2026-11-02T13:45:21+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-02T13:45:21Z","model":"claude-haiku-5-5","output":{"fix":"- Quart `0.23.1` (fixed version per the advisory; `0.23.0` is affected)","reach":"internet","title":"Quart: request bodies, including passwords, printed to stdout in 0.23.0","impact":"medium","summary":"Quart 0.23.0 has a leftover debug print in its request body handling, so every awaited request body is written to standard output. Anyone who can read the app's logs can see submitted form fields such as passwords and CSRF tokens.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","quart","flask-like-apps","wtforms"],"confidence":0.9,"fix_status":"available","needs_auth":"no","worst_case":"Plaintext passwords and form data written to readable logs","analyst_note":"","how_to_check":"- Check the installed version with `pip show quart` or `pip freeze | grep -i quart`; `0.23.0` is affected.\n- Search the app's stdout and log sinks (journald, Docker logs, cloud log aggregation) for `bytearray(b'` strings that contain form field names.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.22.0","version-0.23.1-or-later"],"who_is_affected":"Quart applications on version 0.23.0 that await request bodies, which includes form handling, JSON endpoints via request.get_json(), file uploads and WTForms validate_on_submit(). Exposure requires that stdout or logs are captured somewhere readable, which is the default in most container and systemd setups. Apps on 0.22.0 or 0.23.1 and later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4868,"output_tokens":585,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-532':29B '/login':215C '0.22.0':134C,159C,263C '0.23.0':39B,81C,130C,206C,307C '1':202C '2':210C '3':225C '3.13':209C '4':241C '4cfw':21A,26A 'absent':132C 'accumul':139C 'action':329C 'affect':304C 'aggreg':287C 'anyon':60B 'api':194C 'app':33B,65B,190C,274C,308C 'app.route':214C 'async':218C 'attack':328C 'authent':310C 'await':52B,98C,99C,101C,177C,223C 'b':252C 'beyond':331C 'bodi':5A,48B,54B,96C,113C,142C,179C,247C,294C 'body.__await__':16A,90C,138C 'bytearray':145C,148C,251C 'captur':276C 'cloud':285C 'confirm':127C,131C,258C 'contain':82C 'credenti':297C 'csrf':77B,125C,253C 'cwe':28B 'data':88C,103C,147C,155C,167C,222C,231C,315C 'data.extend':152C 'debug':13A,43B,85C 'def':219C 'detail':135C 'diff':261C 'docker':283C 'e.g':232C 'etc':108C,200C,288C 'everi':51B,174C,291C 'exist':271C 'field':72B,120C,240C 'file':198C 'fire':172C 'flask':31B 'flask-like-app':30B 'form':71B,119C,191C,221C,230C,235C,293C,314C,326C 'full':245C 'ghsa':18A,23A 'ghsa-v853-p72q-4cfw':17A,22A 'handl':49B,309C 'id':238C,256C 'impact':272C 'incl':6A 'includ':117C,295C 'insid':89C 'instal':204C 'json':193C,197C 'leak':2A 'leftov':42B 'len':166C 'like':32B 'line':268C 'log':67B,279C,284C,286C,300C 'login':220C,234C,296C 'major':182C 'method':216C 'minim':211C 'none':164C 'normal':332C 'observ':242C 'output':59B 'overwhelm':181C 'p72q':20A,25A 'packag':34B 'password':8A,75B,123C,239C,257C 'pip':203C 'plaintext':7A,118C,302C 'poc':201C 'post':217C,228C 'post/put':184C 'present':128C,157C 'print':14A,44B,87C,114C,154C,249C 'python':35B,146C,208C,213C 'quart':1A,27A,36B,38B,80C,189C,205C,306C 'quart/wrappers/request.py':92C 'rais':169C 'raw':3A,111C,246C 'read':63B 'redirect':281C 'request':4A,47B,53B,94C,141C,175C 'request.form':100C,224C 'request.get':102C,196C 'request.py':265C 'requestentitytoolarg':170C 'requir':207C,330C 'rout':185C,212C 'see':69B 'self._max_content_length':161C,168C 'self._queue.empty':151C 'self._queue.get_nowait':153C 'sensit':313C 'simpli':323C 'sourc':260C 'src/quart/wrappers/request.py':137C 'staff':237C,255C 'standard':58B 'statement':86C 'stdout':10A,116C,243C,277C 'stray':12A,84C 'submiss':192C 'submit':70B,107C,226C,292C,324C 'summari':79C 'systemd/journald':282C 'termin':280C 'token':78B,126C,254C 'trigger':319C 'trivial':318C 'typic':188C 'unpars':112C 'upload':199C 'use':333C 'user':322C 'v853':19A,24A 'valid':105C 'via':11A,195C,259C 'whose':95C 'written':56B,298C 'wtform':37B,104C","nicknames":[],"mitigations":[],"who_affected":"Quart applications on version 0.23.0 that await request bodies, which includes form handling, JSON endpoints via request.get_json(), file uploads and WTForms validate_on_submit(). Exposure requires that stdout or logs are captured somewhere readable, which is the default in most container and systemd setups. Apps on 0.22.0 or 0.23.1 and later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["quart"],"ptokens":["quart"],"labels":["cwe532","flasklikeapps","high","package","pypi","python","quart","wtforms"],"first_public_at":"2026-10-05T22:49:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-v853-p72q-4cfw","url":"https://github.com/advisories/GHSA-v853-p72q-4cfw","severity":"high","published_at":"2026-10-05T22:49:44+00:00","modified_at":"2026-11-02T13:39:16+00:00","first_seen_at":"2026-11-02T13:44:17+00:00","fetched_at":"2026-11-02T16:48:49+00:00","note":null}],"documents":[{"id":52091,"url":"https://api.github.com/repos/pallets/quart/security-advisories/GHSA-v853-p72q-4cfw","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":52092,"url":"https://github.com/pallets/quart/security/advisories/GHSA-v853-p72q-4cfw","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":52093,"url":"https://github.com/pallets/quart/commit/e8eb3b8a0cb98e7574bf3841312fc7f96883d055","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52094,"url":"https://github.com/pallets/quart/releases/tag/0.23.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}