CVE-2020-7694

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).

• CWE-94
• CWE-116

• https://github.com/encode/uvicornProduct, Third Party Advisory
• https://snyk.io/vuln/SNYK-PYTHON-UVICORN-575560Exploit, Third Party Advisory
• https://github.com/encode/uvicornProduct, Third Party Advisory
• https://snyk.io/vuln/SNYK-PYTHON-UVICORN-575560Exploit, Third Party Advisory

Published

Jul 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7688The issue occurs because tagName user input is formatted ins…7.8
• CVE-2020-7689Data is truncated wrong when its length is greater than 255 …7.5
• CVE-2020-7690All affected versions <2.0.0 of package jspdf are vulnerable…6.1
• CVE-2020-7691In all versions of the package jspdf, it is possible to use …6.1
• CVE-2020-7692PKCE support is not implemented in accordance with the RFC f…9.1
• CVE-2020-7693Incorrect handling of Upgrade header with the value websocke…5.3
• CVE-2020-7695Uvicorn before 0.11.7 is vulnerable to HTTP response splitti…5.3
• CVE-2020-7696This affects all versions of package react-native-fast-image…5.3
• CVE-2020-7697This affects all versions of package mock2easy. a malicious …9.8
• CVE-2020-7698This affects the package Gerapy from 0 and before 0.9.3. The…9.8
• CVE-2020-7699This affects the package express-fileupload before 1.1.8. If…9.8
• CVE-2020-7700All versions of phpjs are vulnerable to Prototype Pollution …9.8