Insertion of Sensitive Information into Log File Affecting quart package, versions [0.23.0,0.23.1)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Insertion of Sensitive Information into Log File vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-QUART-21693784
- published24 Oct 2026
- disclosed5 Oct 2026
- creditUnknown
Introduced: 5 Oct 2026
New CVE NOT AVAILABLE CWE-532 (opens in a new tab)How to fix?
Upgrade Quart to version 0.23.1 or higher.
Overview
Quart is an A Python ASGI web microframework with the same API as Flask
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the __await__ method of src/quart/wrappers/request.py, where a debug print(data) statement causes the raw bytes of every incoming request body to be written to standard output. An unauthenticated remote attacker can exfiltrate sensitive request body content - including credentials, tokens, or personal data - by sending any HTTP request whose body is processed by the server, provided the application's standard output is observable (e.g. via logs, a terminal, or a process supervisor).