Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

quart

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5PyPIAmendedPublished

    Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__

    GHSA-v853-p72q-4cfw

    Affected
    • PyPI quart >= 0.23.0, <= 0.23.0
    Fixed in
    0.23.1· Vendor fix available
    Issue
    Quart 0.23.0 contains a stray debug statement (print(data)) inside Body.await in quart/wrappers/request.py. Any request whose body is awaited — await request.form, await request.getdata(), WTForms validateonsubmit(), etc. — has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0. Details In src/quart/wrappers/request.py, Body.await accumulates the request body into a bytearray: ​ This fires for every request that awaits its body — the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via request.getjson(), file uploads, etc.). PoC 1. pip install quart==0.23.0 (requires Python 3.13+) 2. Minimal route: ​ 3. Submit a POST with form data, e.g. a login form with staffid/password fields. 4. Observe stdout: the full raw body is printed as bytearray(b'csrftoken=...&staffid=...&password=...'). Confirmed via source diff against…

    Recommended action: Upgrade to 0.23.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →
  2. Medium, CVSS 6.9PyPIAmendedPublished

    Werkzeug possible resource exhaustion when parsing file data in forms

    CVE-2024-49767 · GHSA-q34m-jh98-gwm2

    Affected
    • PyPI quart < 0.20.0
    Fixed in
    0.20.0· Vendor fix available
    Issue
    Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.maxformmemorysize setting. The Request.maxcontentlength setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.

    Recommended action: Upgrade to 0.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →