ATRIUMsearch → argument graph
Article · 2026-08-06 · 5 moments

datasette 1.0a38

Release: datasette 1.0a38 This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system. Site administrators who serve private tables in this way are advised to disable the execute-sql permission ` on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed us ✦ AI generated

Read original ↗
GUEST Datasette projectHOST Simon Willison
01
Claim

Datasette 1.0a38 fixes a SQL injection security issue affecting instances that serve a mixture of public and private tables in the same database with access configured via the Datasette permissions system.

This release notes that Datasette 1.0a38 fixes a SQL injection security issue affecting instances that serve a mixture of public and private tables in the same database where access is configured using the Datasette permissions system.

transcript

Datasette project: This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system.

explains mechanism · 2

02
Mechanism

Site administrators who serve private tables in this way should disable the execute-sql permission on that database to prevent users from accessing private tables using raw SQL queries.

The advisory recommends that site administrators serving private tables disable the execute-sql permission on that database to block users from reaching private tables through raw SQL queries.

transcript

Datasette project: Site administrators who serve private tables in this way are advised to disable the execute-sql permission ` on that database to prevent users from accessing private tables using raw SQL queries.

explains mechanism · 1

03
Context

The configuration of private and public tables exposed for the same database within the same instance is likely rare.

The author notes this particular configuration — private and public tables exposed for the same database within the same instance — is likely rare, and states they have never encountered such an instance personally.

transcript

Datasette project: Thankfully this particular configuration - private tables and public tables exposed for the same database within the same instance - is likely to be rare. I've not encountered an instance like that myself.

04
Mechanism◆

The fixed bug would have allowed any user with access to a public table to execute SQL injection attacks and gain read-only access to data in private tables in the same database.

The fixed bug permitted users with access to any public table to run SQL injection attacks despite the restriction, granting them read-only access to data in private tables in the same database.

transcript

Datasette project: The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database.

Highlight slides
SQL Injection Bug Fixed✦ from: The fixed bug would have allowed any user with access to a public table to execute SQL injection attacks and gain read-only access to data in private tables in the same database.
Related episodes
Video · 20VC

Leo Aschenbrenner's Situational Awareness Blows Up | Moonshot AI Raises $3.5B at $35B

→
Video · 20VC

Jensen's Open-Weights Letter | Google Cloud Grows 82% But The Market Tanks

→
Video · Syntax

Do You Read The Code? ⟡ HTTP Gets a NEW Method ⟡ Codex Gets Sol Ultra ⌁ Syntax Weekly ⌁

→