Mechanism◆Article
The fixed bug would have allowed any user with access to a public table to execute SQL injection attacks and gain read-only access to data in private tables in the same database.
The fixed bug permitted users with access to any public table to run SQL injection attacks despite the restriction, granting them read-only access to data in private tables in the same database. ✦ AI generated
Datasette project · Simon Willison's Weblog · 2026-08-06 · original ↗
The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database.
Read full article ↗excerpt · fair-use quotation
- ·Bug allowed SQL injection on public tables
- ·Restriction bypassed in public table access
- ·Gave read-only access to private tables
- ·Data in same database at risk
- ·Now fixed
Around this claim
This moment responds to
explains mechanism → Datasette 1.0a38 fixes a SQL injection security issue affecting instances that serve a mixture of public and private tables in the same database with access configured via the Datasette permissions system.Datasette project · Simon Willison's Weblogexplains mechanism → Site administrators who serve private tables in this way should disable the execute-sql permission on that database to prevent users from accessing private tables using raw SQL queries.Datasette project · Simon Willison's Weblog