MechanismArticle

Site administrators who serve private tables in this way should disable the execute-sql permission on that database to prevent users from accessing private tables using raw SQL queries.

The advisory recommends that site administrators serving private tables disable the execute-sql permission on that database to block users from reaching private tables through raw SQL queries. ✦ AI generated

Datasette project · Simon Willison's Weblog · 2026-08-06 · original ↗

Share card ↓Export .md Export .txt

Site administrators who serve private tables in this way are advised to disable the execute-sql permission ` on that database to prevent users from accessing private tables using raw SQL queries.

Read full article ↗excerpt · fair-use quotation

✳ Datasette

Around this claim

Mechanism · 1

The fixed bug would have allowed any user with access to a public table to execute SQL injection attacks and gain read-only access to data in private tables in the same database.Datasette project · Simon Willison's Weblog · conf 60%

This moment responds to

explains mechanism → Datasette 1.0a38 fixes a SQL injection security issue affecting instances that serve a mixture of public and private tables in the same database with access configured via the Datasette permissions system.Datasette project · Simon Willison's Weblog