Morgan versions prior to 1.12.1 are vulnerable to log injection via unescaped double quotes in quoted log fields. This vulnerability allows an attacker controlling certain request fields to inject double quotes that prematurely close quoted fields in the Apache combined log format, enabling forged log entries. The issue affects the combined, common, default, and any custom formats that quote tokens. A fix is available in version 1.12.1.