Datasette 1.0a38 patches a SQL injection that exposed private tables
Simon Willison shipped Datasette 1.0a38 and 0.65.3 to close a SQL injection bug: access to any public table also yielded read-only access to private tables in the same database, even with the execute-sql permission disabled. Willison has never encountered that configuration in the wild, so the blast radius is small — but any deployment leaning on per-table permissions as its privacy boundary needs the patch.
Source: simonwillison.net ↗
The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database.
Simon Willison
Why this matters
- → SQL injection bypass let users read private tables despite permission restrictions
- → Affects mixed public/private deployments using Datasette's permission system
- → Rare config but critical for any instance relying on per-table privacy boundaries
SQL injection in permissions