Technical impact
Python‑Multipart is a streaming multipart parser for Python that, before version 0.0.30, interpreted semicolons as an additional separator in application/x‑www‑form‑url‑encoded bodies, diverging from the WHATWG URL standard that uses only ampersands. This creates a parser differential where an attacker can craft a HTTP request containing semicolon‑separated parameters that are invisible to upstream compliance layers but become part of the parsed data, enabling injection of hidden form fields. The practical consequence is that validation, authentication, or authorization logic that relies on the contents of the parsed form data can be subverted, allowing an attacker to influence application behavior through unexpected parameters.
Affected Systems
The flaw exists in all releases of Kludex python‑multipart older than 0.0.30. Any system that uses this library to parse multipart or application/x‑www‑form‑url‑encoded request bodies is impacted. The bug was fixed in release 0.0.30.
Risk and Exploitability
The CVSS score of 3.7 indicates a moderate potential impact, and the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need remote network access to the target to send a crafted HTTP request containing a semicolon‑delimited body; the attack vector is therefore remote and requires no local execution or elevated privileges. The likely outcome of a successful exploit is the injection of hidden parameters that can bypass or subvert application logic. Because the vulnerability is limited to parameter smuggling, it does not provide direct code execution but can still undermine the integrity of the application’s input validation or authentication checks.
Github GHSA