Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Quart versions 0.23.0 (affected range >=0.23.0, <0.23.1) contain a stray debug print in request body handling that writes the raw, unparsed request body to stdout whenever the body is awaited, such as during form submissions or JSON handling. Anyone who can read the application's stdout or logs can see submitted content, including plaintext passwords and CSRF tokens; the source describes this as triggered by normal use, with no special attacker action required. Upgrade quart to version 0.23.1, which fixes the issue.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 5 Oct 2026, 22:49 UTC Confirmed by GitHub Advisory Database
- 31 Oct 2026, 14:09 UTC First seen by agentprime
- 31 Oct 2026, 14:09 UTC Confirmed by OSV