event · Story package
Datasette fixes a SQL-injection flaw and backports the patch
Datasette 1.0a38 addresses read-only access to private tables under a mixed-permission configuration, and version 0.65.3 carries the same fix.
Overview
Simon Willison reports that Datasette 1.0a38 fixes a SQL-injection flaw involving databases that contain both public and private tables. Under the described permissions setup, affected users could gain read-only access to private tables despite an execute-SQL restriction.
A separate maintenance release, Datasette 0.65.3, backports the same security fix. The supplied evidence supports the release and backport account but does not include an independent security audit.
Why it matters
The flaw concerns access controls around private data, making affected mixed-permission deployments important to review.
The backport extends the fix to users who remain on the 0.65 release line.
Key facts
Datasette 1.0a38 is reported to fix a SQL-injection flaw involving mixed public and private tables under its permissions system.
The release account says affected users could gain read-only access to private tables in the same database despite an execute-SQL restriction.
Datasette 0.65.3 backports the security fix from version 1.0a38.
Latest update
No public update is available.
Full timeline
No public timeline entries are available.
Sources
Open questions
- Which deployed versions and permission configurations are affected?
- What additional advisory or audit evidence will document the flaw and its remediation?
Related stories
No related stories are listed.