ClaimArticle

Datasette 1.0a38 fixes a SQL injection security issue affecting instances that serve a mixture of public and private tables in the same database with access configured via the Datasette permissions system.

This release notes that Datasette 1.0a38 fixes a SQL injection security issue affecting instances that serve a mixture of public and private tables in the same database where access is configured using the Datasette permissions system. ✦ AI generated

Datasette project · Simon Willison's Weblog · 2026-08-06 · original ↗

Share card ↓Export .md Export .txt

This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system.

Read full article ↗excerpt · fair-use quotation

✳ Datasette

Around this claim

Mechanism · 2

The fixed bug would have allowed any user with access to a public table to execute SQL injection attacks and gain read-only access to data in private tables in the same database.Datasette project · Simon Willison's Weblog · conf 80%Site administrators who serve private tables in this way should disable the execute-sql permission on that database to prevent users from accessing private tables using raw SQL queries.Datasette project · Simon Willison's Weblog · conf 70%