pypi quart vulnerabilities

Latest pypi quart CVEs

Newest publication first

1. GHSA-v853-p72q-4cfw Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__

   Published 2026-10-05

   High·CVSS 7.5

   Summary Quart 0.23.0 contains a stray debug statement (print(data)) inside Body.__await__ in quart/wrappers/request.py. Any request whose body is awaited — await request.form, await request.get_data(), WTForms validate_on_submit(), etc. — has its raw, unparsed body printed to std...

2. CVE-2024-49767 Werkzeug possible resource exhaustion when parsing file data in forms

   Published 2024-10-25

   Medium·CVSS 6.9 EPSS 1.1%

   Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parse multipart/form-data requests (e.g. all flask applications) are vulnerable to a relatively simp...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.