Log injection in uvicorn
This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | uvicorn | < 0.11.7 | 0.11.7 |
References
- https://snyk.io/vuln/SNYK-PYTHON-UVICORN-575560
- https://github.com/encode/uvicorn
- https://github.com/advisories/GHSA-33c7-2mpw-hg34
- https://nvd.nist.gov/vuln/detail/CVE-2020-7694
- https://github.com/encode/uvicorn/issues/723
- https://github.com/encode/uvicorn/commit/895807f94ea9a8e588605c12076b7d7517cda503
- https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-150.yaml
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-116, CWE-94- Platform
- Python (PyPI)
- Package
uvicorn- Disclosed
- 27.07.2020
- Updated
- 11.10.2026 11:20
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2020-150 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-33c7-2mpw-hg34 - CC BY 4.0
Vulnerability history: uvicorn
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 07.2020 07.2020
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
Disclosures per year
- 2020: 2
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Log injection in uvicorn this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.