↓Skip to main content
Zeitgeist — a spike by Chris Gathercole
  1. Creators/
  2. Simon Willison — Creator of Datasette; co-creator of Django/

datasette 1.0a38

Blog · Watch/Read

  • Datasette 1.0a38 (and 0.65.3) was released to patch a SQL injection security vulnerability.
  • The bug specifically affected Datasette instances serving a mixture of public and private tables in the same database, allowing users with access to public tables to gain read-only access to private data, even if the execute-sql permission was disabled.
  • Site administrators with this specific configuration (public and private tables in the same database instance) are advised to update immediately to 1.0a38 or 0.65.3 to prevent potential data exposure, though Simon notes this setup is “likely to be rare.”