{"id":"GHSA-674p-xv2x-rf3g","aliases":[],"url":"https://o3.security/vulnerability/GHSA-674p-xv2x-rf3g","summary":"Litestar has potential log injection in exception logging","details":"### Summary\n\nLitestar does not escape url paths when logging exceptions. This makes logger vulnerable to CRLF injection if logging level is configured to debug or `log_exceptions` is set to \"always\", which allows attackers to inject newlines and forge log entries.\n\n### Details\n\nLitestar directly formats unquoted path into exception logs without validation or escaping when using default exception logging handler.\n\nhttps://github.com/litestar-org/litestar/blob/1e0dc7c4d67151c836208a3e360051e983b5083a/litestar/logging/config.py#L145-L150\n\nAttackers can inject newlines in logs by embedding`%0d%0a` in url path.\n\n`log_exceptions=\"always\"` is not enabled by default. However, it is set in the examples of documentation (https://github.com/litestar-org/litestar/blob/1e0dc7c4d67151c836208a3e360051e983b5083a/docs/usage/logging.rst#logging). User will be impacted if they directly copy the logging config from docs.\n\n### PoC\n\n```\ncurl \"http://172.17.0.2:8000/%29%0D%0AINFO:%20%20%20%20%20127.0.0.1:8192%20-%20%22POST%20/login%20HTTP/1.1%22%20200%20OK%0D%0A%28\"\n```\n\nlogging:\n\n```\n2025-07-15 00:00:00 - litestar - ERROR - Uncaught exception (connection_type=http, path=/)\nINFO:     127.0.0.1:8192 - \"POST /login HTTP/1.1\" 200 OK\n...\n```\n\nIf stacktracks for 404 are configured to be ignored (`disable_stack_trace={404},`), attacker may also exploit this by sending malformed requests to cause 400/500 exceptions and avoid 404 in endpoints with str path parameters.","published":"2025-08-11T23:07:36Z","modified":"2025-08-12T00:12:19.054355Z","cvss":{"score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"litestar","fixedVersion":"2.17.0"}],"fix":{"url":"https://github.com/litestar-org/litestar/commit/03b5813d4f448dd710af9ba6252d798cb9fc087f","label":"litestar-org/litestar@03b5813"},"references":[{"type":"WEB","url":"https://github.com/litestar-org/litestar/security/advisories/GHSA-674p-xv2x-rf3g"},{"type":"WEB","url":"https://github.com/litestar-org/litestar/commit/03b5813d4f448dd710af9ba6252d798cb9fc087f"},{"type":"PACKAGE","url":"https://github.com/litestar-org/litestar"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-08-12T00:12:19.054355Z"}}