Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
### Summary Quart 0.23.0 contains a stray debug statement (`print(data)`) inside `Body.__await__` in `quart/wrappers/request.py`. Any request whose body is awaited — `await request.form`, `await request.get_data()`, WTForms `validate_on_submit()`, etc. — has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0. ### Details In `src/quart/wrappers/request.py`, `Body.__await__` accumulates the request body into a bytearray: ```python data = bytearray() while not self._queue.empty(): data.extend(self._queue.get_nowait()) print(data) # <-- not present in 0.22.0 if ( self._max_content_length is not None and len(data) > self._max_content_length ): raise RequestEntityTooLarge() ``` This fires for every request that awaits its body — the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via `request.get_json()`, file uploads, etc.). ### PoC 1. `pip install quart==0.23.0` (requires Python 3.13+) 2. Minimal route: ```python @app.route("/login", methods=["POST"]) async def login(): form_data = await request.form ... ``` 3. Submit a POST with form data, e.g. a login form with `staff_id`/`password` fields. 4. Observe stdout: the full raw body is printed as `bytearray(b'csrf_token=...&staff_id=...&password=...')`. Confirmed via source diff against 0.22.0's `request.py`, where this line does not exist. ### Impact Any app that captures
GHSA-v853-p72q-4cfw
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-v853-p72q-4cfw
quart
Source reference: /affected/0/package/name
- Affected versions
- 0.23.0
Source reference:
/affected/0/versions - Fixed versions
- 0.23.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.23.0"
},
{
"fixed": "0.23.1"
}
]
}
],
"package": {
"name": "quart",
"purl": "pkg:pypi/quart",
"ecosystem": "PyPI"
},
"versions": [
"0.23.0"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-v853-p72q-4cfw/GHSA-v853-p72q-4cfw.json"
}
}
]Publisher severity
high
Source reference: /database_specific/severity
- Event
- #85871 · Revision 1
- Added to Heist Feed
- Publisher date