Quart 0.23.0 contains a stray debug statement (print(data)) inside Body. await in quart/wrappers/request.py. Any request whose body is awaited — await request.form, await request.get data(), WTForms validate on submit(), etc. — has its raw, unparsed body printed to stdout, including plaintext form fields such as passwords and CSRF tokens. Confirmed present in 0.23.0, confirmed absent in 0.22.0.

In src/quart/wrappers/request.py, Body. await accumulates the request body into a bytearray:

​python data = bytearray() while not self. queue.empty(): data.extend(self. queue.get nowait()) print(data) # <-- not present in 0.22.0 if ( self. max content length is not None and len(data) > self. max content length ): raise RequestEntityTooLarge() ​

This fires for every request that awaits its body — the overwhelming majority of POST/PUT routes in a typical Quart app (form submissions, JSON APIs via request.get json(), file uploads, etc.).

Confirmed via source diff against 0.22.0's request.py, where this line does not exist.

Any app that captures stdout in logs (terminal redirect, systemd/journald, Docker logs, cloud log aggregation, etc.) will have every submitted form body — including login credentials — written to logs in plaintext. This affects any Quart 0.23.0 app handling authentication or any sensitive form data, and is trivially triggerable by any user simply submitting a form (no attacker action required beyond normal use).