{"schemaVersion":3,"id":"CVE-2020-7694","aliases":["GHSA-33c7-2mpw-hg34","PYSEC-2020-150","SNYK-PYTHON-UVICORN-575560","UBUNTU-CVE-2020-7694","DEBIAN-CVE-2020-7694"],"status":"published","duplicateOf":null,"title":null,"description":"This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).","dates":{"published":"2020-07-27T11:25:12.371Z","modified":"2024-09-17T00:30:44.758Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Pypi","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01357,"percentile":0.71263,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01357},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01357,"percentile":0.71263}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01357,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01357,"percentile":0.71263}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_987D18225FB68766","name":"Exploit Reference (snyk.io)","source":"reference","url":"https://snyk.io/vuln/SNYK-PYTHON-UVICORN-575560","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/94.html"},{"id":"CWE-116","name":"Improper Encoding or Escaping of Output","description":"The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/116.html"}],"affected":[{"vendor":"debian","product":"python-uvicorn","name":"python-uvicorn","label":"python-uvicorn","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/python-uvicorn","purlType":"deb","versions":[{"text":"< 0.13.3-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.3-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"python-uvicorn","name":"python-uvicorn","label":"python-uvicorn","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/python-uvicorn","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"encode","product":"uvicorn","name":"uvicorn","label":"uvicorn","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/encode/uvicorn"},{"vendor":"PyPI","product":"uvicorn","name":"uvicorn","label":"uvicorn","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/uvicorn","purlType":"pypi","versions":[{"text":"< 0.11.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.11.7","eol":null,"hubHref":null}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://snyk.io/vuln/SNYK-PYTHON-UVICORN-575560","label":"snyk.io/vuln/SNYK-PYTHON-UVICORN-575560","hostname":"snyk.io","tags":["X Refsource MISC","WEB","Advisory","REPORT","Exploit","Third Party Advisory"]},{"url":"https://github.com/encode/uvicorn","label":"github.com/encode/uvicorn","hostname":"github.com","tags":["X Refsource MISC","PACKAGE","WEB","REPORT","Product","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7694","label":"nvd.nist.gov/vuln/detail/CVE-2020-7694","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/encode/uvicorn/issues/723","label":"github.com/encode/uvicorn/issues/723","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/encode/uvicorn/commit/895807f94ea9a8e588605c12076b7d7517cda503","label":"github.com/encode/uvicorn/commit/895807f94ea9a8e588605c12076b7d7517cda503","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-150.yaml","label":"github.com/pypa/advisory-database/tree/main/vulns/uvicorn/PYSEC-2020-150.yaml","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/advisories/GHSA-33c7-2mpw-hg34","label":"github.com/advisories/GHSA-33c7-2mpw-hg34","hostname":"github.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-7694","label":"ubuntu.com/security/CVE-2020-7694","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7694","label":"www.cve.org/CVERecord?id=CVE-2020-7694","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-7694","label":"security-tracker.debian.org/tracker/CVE-2020-7694","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-07-27T11:25:12.371Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-17T00:30:44.758Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":40,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T22:19:36.557Z","stale":false,"partial":false}}