{"answers":{"affected":"2 open source packages ship an affected version, including quart.","exploited":"There is no known exploitation of GHSA-v853-p72q-4cfw in the wild and no public exploit code.","fix":"Upgrade quart to 0.23.1 or later.","what":"GHSA-v853-p72q-4cfw is a vulnerability in quart, published on 5 Oct 2026."},"fix_prompt":"Check this codebase for GHSA-v853-p72q-4cfw and fix it if it is affected.\n\nWhat it is: GHSA-v853-p72q-4cfw is a vulnerability in quart, published on 5 Oct 2026. \nExploitation: There is no known exploitation of GHSA-v853-p72q-4cfw in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- quart (PyPI): affected from 0.23.0; fixed in 0.23.1\n- quart (PyPI): affected from 0.23.0; fixed in 0.23.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-v853-p72q-4cfw/ (Markdown: https://insights.sbomify.com/GHSA-v853-p72q-4cfw/index.md)","id":"GHSA-v853-p72q-4cfw","markdown":"https://insights.sbomify.com/GHSA-v853-p72q-4cfw/index.md","name":"GHSA-v853-p72q-4cfw","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nQuart 0.23.0 contains a stray debug statement (`print(data)`) inside `Body.__await__` in `quart/wrappers/request.py`. Any request whose body is awaited — `await request.form`, `await request.get_data()`, WTForms `validate_on_submit()`, etc. — has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0.\n\n### Details\nIn `src/quart/wrappers/request.py`, `Body.__await__` accumulates the request body into a bytearray:\n\n​```python\ndata = bytearray()\nwhile not self._queue.empty():\n    data.extend(self._queue.get_nowait())\n    print(data)          # \u003c-- not present in 0.22.0\n    if (\n        self._max_content_length is not None\n        and len(data) \u003e self._max_content_length\n    ):\n        raise RequestEntityTooLarge()\n​```\n\nThis fires for every request that awaits its body — the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via `request.get_json()`, file uploads, etc.).\n\n### PoC\n1. `pip install quart==0.23.0` (requires Python 3.13+)\n2. Minimal route:\n​```python\n@app.route(\"/login\", methods=[\"POST\"])\nasync def login():\n    form_data = await request.form\n    ...\n​```\n3. Submit a POST with form data, e.g. a login form with `staff_id`/`password` fields.\n4. Observe stdout: the full raw body is printed as `bytearray(b'csrf_token=...\u0026staff_id=...\u0026password=...')`.\n\nConfirmed via source diff against 0.22.0's `request.py`, where this line does not exist.\n\n### Impact\nAny app that captures stdout in logs (terminal redirect, systemd/journald, Docker logs, cloud log aggregation, etc.) will have every submitted form body — including login credentials — written to logs in plaintext. This affects any Quart 0.23.0 app handling authentication or any sensitive form data, and is trivially triggerable by any user simply submitting a form (no attacker action required beyond normal use).","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__","id":"GHSA-v853-p72q-4cfw","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["0.23.1"],"introduced":["0.23.0"],"last_affected":[],"package":"quart","purl":null,"source":"GHSA-v853-p72q-4cfw"},{"ecosystem":"PyPI","fixed":["0.23.1"],"introduced":["0.23.0"],"last_affected":[],"package":"quart","purl":"pkg:pypi/quart","source":"GHSA-v853-p72q-4cfw"}],"products":null,"published":"2026-10-05","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/GHSA-v853-p72q-4cfw/"}