# Quart information disclosure via debug print in request body handling

Source: https://junglewise.ai/threats/quart-leaks-raw-request-body-incl-plaintext-passwords-to-stdout-via-02b677a8  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-10-05

Quart, a Python web framework for handling HTTP requests, contains an accidental debug print statement that leaks the raw request body to standard output. Any application that logs stdout—such as Docker containers or systemd—will capture plaintext passwords, CSRF tokens, and other sensitive form data submitted by users. The vulnerability affects all POST and PUT requests in Quart 0.23.0.

Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 5 October 2026.

**Which products and versions are affected?** Quart (PyPI) = 0.23.0; Quart 0.23.0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Quart (PyPI) or Quart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stray print(data) statement in Body.__await__ within quart/wrappers/request.py causes the raw, unparsed request body to be printed to stdout during the processing of any awaited request body (form data, JSON, file uploads, etc.). The vulnerability is triggered automatically on normal application usage with no special preconditions—any user submitting a form triggers the leak. The debug statement was present in 0.23.0 but confirmed absent in 0.22.0.

## Affected products

- Quart Quart 0.23.0

## Timeline

- 2026-10-05: disclosed

## Related threats

- [Pallets Werkzeug resource exhaustion in multipart form parsing](https://junglewise.ai/threats/cve-2024-49767-pallets-werkzeug-resource-exhaustion-in-multipart-form-parsing)