Skip to content
Heist/ feed
HighFix available

Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__

Type: advisorySource: OSV1 source record

### Summary Quart 0.23.0 contains a stray debug statement (`print(data)`) inside `Body.__await__` in `quart/wrappers/request.py`. Any request whose body is awaited — `await request.form`, `await request.get_data()`, WTForms `validate_on_submit()`, etc. — has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0. ### Details In `src/quart/wrappers/request.py`, `Body.__await__` accumulates the request body into a bytearray: ​```python data = bytearray() while not self._queue.empty(): data.extend(self._queue.get_nowait()) print(data) # <-- not present in 0.22.0 if ( self._max_content_length is not None and len(data) > self._max_content_length ): raise RequestEntityTooLarge() ​``` This fires for every request that awaits its body — the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via `request.get_json()`, file uploads, etc.). ### PoC 1. `pip install quart==0.23.0` (requires Python 3.13+) 2. Minimal route: ​```python @app.route("/login", methods=["POST"]) async def login(): form_data = await request.form ... ​``` 3. Submit a POST with form data, e.g. a login form with `staff_id`/`password` fields. 4. Observe stdout: the full raw body is printed as `bytearray(b'csrf_token=...&staff_id=...&password=...')`. Confirmed via source diff against 0.22.0's `request.py`, where this line does not exist. ### Impact Any app that captures

Announced Source revision 1
Original source ↗

GHSA-v853-p72q-4cfw

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-v853-p72q-4cfw

quart

Source reference: /affected/0/package/name

Affected versions
0.23.0

Source reference: /affected/0/versions

Fixed versions
0.23.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0.23.0"
          },
          {
            "fixed": "0.23.1"
          }
        ]
      }
    ],
    "package": {
      "name": "quart",
      "purl": "pkg:pypi/quart",
      "ecosystem": "PyPI"
    },
    "versions": [
      "0.23.0"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-v853-p72q-4cfw/GHSA-v853-p72q-4cfw.json"
    }
  }
]

Publisher severity

high

Source reference: /database_specific/severity

Event
#85871 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement