InjazAI

Datasette 1.0a38 fixes a SQL injection vulnerability that allowed users with access to public tables to read private data in the same database, urging immediate updates for MENA administrators.

1 min read

Datasette 1.0a38 Released to Fix SQL Injection Vulnerability in Private Tables

Overview

FAQ

What is the SQL injection vulnerability in Datasette?

It allows users with access to public tables to execute raw SQL queries to access private table data in the same database, bypassing permission restrictions.

How can administrators protect their servers?

Update Datasette to 1.0a38 or 0.65.3, and disable the execute-sql permission on databases containing private tables.

Does this affect Datasette users in the Middle East?

Yes, especially government and research institutions sharing public data alongside private data on the same server; immediate configuration review is advised.

Source: Simon Willison (LLM & tools)

AI-assisted content, human-reviewed.