Agentic data science with the Data Agent Kit
cloud.google.com·6h ago
Data Science
Simon Willison's Blog·Aug 6·5 min read
datasette 1.0a38
TL;DR
Datasette 1.0a38 addresses a critical SQL injection vulnerability affecting instances with both public and private tables. Administrators are urged to disable the execute-sql permission to safeguard private data.
✦ Why It Matters
Disable the execute-sql permission on your Datasette instance to protect private data from unauthorized access.
Key Takeaways
- Update to Datasette 1.0a38 to fix security issues.
- Disable execute-sql permissions for databases with mixed table access.
- Review your Datasette instance configuration for security.
- Stay informed about security updates and best practices.
Full Summary
Datasette 1.0a38 has been released to fix a SQL injection security flaw that could allow users with access to public tables to execute unauthorized SQL queries, potentially exposing private table data within the same database. This vulnerability arises when a Datasette instance serves both public and private tables, with access managed through its permissions system.
To mitigate this risk, site administrators are advised to disable the execute-sql permission for databases containing private tables. Although this configuration is uncommon, the fix is crucial for those who might be using it.
The same security fix is also included in Datasette version 0.65.3, ensuring broader protection across versions. The rarity of this setup suggests that many users may not be directly affected, but vigilance is still necessary.