Improper Output Neutralization for Logs Affecting litestar package, versions [,2.17.0)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Improper Output Neutralization for Logs vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-LITESTAR-11776954
- published12 Aug 2025
- disclosed11 Aug 2025
- creditCycloctane
Introduced: 11 Aug 2025
New CVE NOT AVAILABLE CWE-117 (opens in a new tab)How to fix?
Upgrade litestar to version 2.17.0 or higher.
Overview
litestar is a Litestar - A production-ready, highly performant, extensible ASGI API Framework
Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the exception logging process. An attacker can manipulate log files and forge log entries by injecting newline characters into the URL path, which are then improperly handled during exception logging.
Note:
This is only exploitable if the logging level is set to debug or if log_exceptions is configured as "always".
PoC
curl "http://172.17.0.2:8000/%29%0D%0AINFO:%20%20%20%20%20127.0.0.1:8192%20-%20%22POST%20/login%20HTTP/1.1%22%20200%20OK%0D%0A%28"