datasette 1.0a38

Simon Willison's Weblog reports that Datasette version one point zero alpha thirty-eight fixes a SQL injection security vulnerability. The bug affects instances that expose both public and private tables within the same database using Datasette's permissions system. A user with access to public tables could use SQL injection to read data from private tables. The developer notes the configuration is likely rare; the fix is also backported to version zero point sixty-five point three.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton