# GHSA-v853-p72q-4cfw: Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 5 Oct 2026

## What is GHSA-v853-p72q-4cfw?

GHSA-v853-p72q-4cfw is a vulnerability in quart, published on 5 Oct 2026. 

### Official description

### Summary
Quart 0.23.0 contains a stray debug statement (`print(data)`) inside `Body.__await__` in `quart/wrappers/request.py`. Any request whose body is awaited — `await request.form`, `await request.get_data()`, WTForms `validate_on_submit()`, etc. — has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0.

### Details
In `src/quart/wrappers/request.py`, `Body.__await__` accumulates the request body into a bytearray:

​```python
data = bytearray()
while not self._queue.empty():
    data.extend(self._queue.get_nowait())
    print(data)          # <-- not present in 0.22.0
    if (
        self._max_content_length is not None
        and len(data) > self._max_content_length
    ):
        raise RequestEntityTooLarge()
​```

This fires for every request that awaits its body — the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via `request.get_json()`, file uploads, etc.).

### PoC
1. `pip install quart==0.23.0` (requires Python 3.13+)
2. Minimal route:
​```python
@app.route("/login", methods=["POST"])
async def login():
    form_data = await request.form
    ...
​```
3. Submit a POST with form data, e.g. a login form with `staff_id`/`password` fields.
4. Observe stdout: the full raw body is printed as `bytearray(b'csrf_token=...&staff_id=...&password=...')`.

Confirmed via source diff against 0.22.0's `request.py`, where this line does not exist.

### Impact
Any app that captures stdout in logs (terminal redirect, systemd/journald, Docker logs, cloud log aggregation, etc.) will have every submitted form body — including login credentials — written to logs in plaintext. This affects any Quart 0.23.0 app handling authentication or any sensitive form data, and is trivially triggerable by any user simply submitting a form (no attacker action required beyond normal use).

## Which versions are affected by GHSA-v853-p72q-4cfw?

2 open source packages ship an affected version, including quart.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `quart` | PyPI | From 0.23.0 | 0.23.1 |
| `quart` | PyPI | From 0.23.0 | 0.23.1 |

## How do I fix GHSA-v853-p72q-4cfw?

Upgrade quart to 0.23.1 or later.

## Is GHSA-v853-p72q-4cfw being exploited?

There is no known exploitation of GHSA-v853-p72q-4cfw in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-v853-p72q-4cfw and fix it if it is affected.

What it is: GHSA-v853-p72q-4cfw is a vulnerability in quart, published on 5 Oct 2026. 
Exploitation: There is no known exploitation of GHSA-v853-p72q-4cfw in the wild and no public exploit code.

Affected packages and fixed versions:
- quart (PyPI): affected from 0.23.0; fixed in 0.23.1
- quart (PyPI): affected from 0.23.0; fixed in 0.23.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-v853-p72q-4cfw/ (Markdown: https://insights.sbomify.com/GHSA-v853-p72q-4cfw/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-v853-p72q-4cfw

---
From sbomify Insights: https://insights.sbomify.com/GHSA-v853-p72q-4cfw/
Summaries are generated and may contain mistakes; the official description above is the record.