---
title: "Datasette 1.0a38 Fixes SQL Injection in Mixed Public/Private Table Setups"
source: "Simon Willison 博客（Atom）"
source_tier: "t2"
url: "https://simonwillison.net/2026/Aug/6/datasette/#atom-everything"
permalink: "https://feed.astralor.com/items/itm_51cad51790e43db7a135192f"
published: "2026-08-06T18:24:34.000Z"
score: 72
channel: "tech"
tags: ["Datasette","SQL injection","Permission security"]
---

# Datasette 1.0a38 Fixes SQL Injection in Mixed Public/Private Table Setups

## AI commentary

> This security fix has a narrow impact but deserves attention from all Datasette users, as permission bypass issues are often hidden and severe. If you maintain strictly separated public and private data, this update is a low-cost opportunity to harden your system.

## At a glance

Datasette 1.0a38 has been released, fixing a SQL injection vulnerability affecting instances that serve a mix of public and private tables in the same database. The bug allowed users with access to any public table to bypass the execute-sql permission restriction and gain read-only access to private tables via SQL injection. Administrators using this configuration are advised to disable execute-sql on that database. The fix is also available in Datasette 0.65.3. Such mixed deployments are likely rare, so the impact is limited.

## Key points

- Datasette 1.0a38 fixes a SQL injection vulnerability in instances mixing public and private tables in the same database.
- The flaw bypasses the execute-sql permission, allowing read-only access to private tables via raw SQL queries.
- Administrators are advised to disable execute-sql on affected databases and upgrade to 1.0a38 or 0.65.3.
- The mixed deployment scenario is rare, so the actual number of affected instances is likely low.

## Full text

Release: datasette 1.0a38 This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system. Site administrators who serve private tables in this way are advised to disable the execute-sql permission ` on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database. This fix is also available in Datasette 0.65.3. Thankfully this particular configuration - private tables and public tables exposed for the same database within the same instance - is likely to be rare. I've not encountered an instance like that myself. Tags: security, sql-injection, datasette

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_51cad51790e43db7a135192f