---
id: "GHSA-v853-p72q-4cfw"
kind: "vulnerability"
aliases: ["GHSA-v853-p72q-4cfw"]
title: "Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "quart", "fixed": ["0.23.1"], "affected": "= 0.23.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-532", "flask-like-apps", "package", "python", "quart", "wtforms"]
not_affected_if: ["version-0.22.0", "version-0.23.1-or-later"]
published_at: "2026-10-05T22:49:44+00:00"
first_seen_at: "2026-11-02T13:44:17+00:00"
updated_at: "2026-11-02T13:45:21+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-v853-p72q-4cfw", "first_seen_at": "2026-11-02T13:44:17+00:00"}]
---

# Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__

Quart 0.23.0 has a leftover debug print in its request body handling, so every awaited request body is written to standard output. Anyone who can read the app's logs can see submitted form fields such as passwords and CSRF tokens.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:quart affected = 0.23.0 fixed 0.23.1

## How to check

- Check the installed version with `pip show quart` or `pip freeze | grep -i quart`; `0.23.0` is affected.
- Search the app's stdout and log sinks (journald, Docker logs, cloud log aggregation) for `bytearray(b'` strings that contain form field names.

## Fix

- Quart `0.23.1` (fixed version per the advisory; `0.23.0` is affected)

## Timeline

- 2026-11-02T13:44:17+00:00 ghsa https://github.com/advisories/GHSA-v853-p72q-4cfw

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/pallets/quart/security-advisories/GHSA-v853-p72q-4cfw
- [advisory] Maintainer's advisory: github.com https://github.com/pallets/quart/security/advisories/GHSA-v853-p72q-4cfw
- [fix] Patch: github.com https://github.com/pallets/quart/commit/e8eb3b8a0cb98e7574bf3841312fc7f96883d055
- [fix] Release: github.com https://github.com/pallets/quart/releases/tag/0.23.1

## From the sources

### Summary
Quart 0.23.0 contains a stray debug statement (`print(data)`) inside `Body.__await__` in `quart/wrappers/request.py`. Any request whose body is awaited — `await request.form`, `await request.get_data()`, WTForms `validate_on_submit()`, etc. — has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0.

### Details
In `src/quart/wrappers/request.py`, `Body.__await__` accumulates the request body into a bytearray:

​```python
data = bytearray()
while not self._queue.empty():
    data.extend(self._queue.get_nowait())
    print(data)          # <-- not present in 0.22.0
    if (
        self._max_content_length is not None
        and len(data) > self._max_content_length
    ):
        raise RequestEntityTooLarge()
​```

This fires for every request that awaits its body — the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via `request.get_json()`, file uploads, etc.).

### PoC
1. `pip install quart==0.23.0` (requires Python 3.13+)
2. Minimal route:
​```python
@app.route("/login", methods=["POST"])
async def login():
    form_data = await request.form
    ...
​```
3. Submit a POST with form data, e.g. a login form with `staff_id`/`password` fields.
4. Observe stdout: the full raw body is printed as `bytearray(b'csrf_token=...&staff_id=...&password=...')`.

Confirmed via source diff against 0.22.0's `request.py`, where this line does not exist.

### Impact
Any app that captures stdout in logs (terminal redirect, systemd/journald, Docker logs, cloud log aggregation, etc.) will have every submitted form body — including login credentials — written to logs in plaintext. This affects any Quart 0.23.0 app handling authentication or any sensitive form data, and is trivially triggerable by any user simply submitting a form (no attacker action required beyond normal use).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_