---
title: "Datasette 1.0a38 修复混合公开/私有表场景下的 SQL 注入漏洞"
source: "Simon Willison 博客（Atom）"
source_tier: "t2"
url: "https://simonwillison.net/2026/Aug/6/datasette/#atom-everything"
permalink: "https://feed.astralor.com/items/itm_51cad51790e43db7a135192f"
published: "2026-08-06T18:24:34.000Z"
score: 72
channel: "tech"
tags: ["Datasette","SQL注入","权限安全"]
---

# Datasette 1.0a38 修复混合公开/私有表场景下的 SQL 注入漏洞

## AI 点评

> 这个安全修复虽然影响面小，但值得所有 Datasette 用户关注，因为权限绕过类问题往往隐匿且致命。如果你维护的实例严格隔离公开和私有数据，这次更新是加固系统的低成本机会。

## 速览

Datasette 发布 1.0a38 版本，修复了一个影响同库混合公开表和私有表实例的 SQL 注入安全漏洞。该漏洞允许拥有任意公开表访问权限的用户绕过 execute-sql 权限限制，通过原始 SQL 注入只读访问同库私有表数据。官方建议采用此类配置的管理员禁用数据库的 execute-sql 权限，并同步发布了 0.65.3 版本修复。由于这种公开/私有表混合部署较为罕见，官方认为受影响实例很少。

## 关键点

- Datasette 1.0a38 修复了同一数据库中公开表和私有表混合部署时的 SQL 注入漏洞。
- 该漏洞可绕过 execute-sql 权限限制，让用户通过原始 SQL 查询只读访问私有表。
- 官方建议受影响管理员禁用相关数据库的 execute-sql 权限，并升级到 1.0a38 或 0.65.3。
- 由于混合部署场景少见，实际受影响实例可能非常有限。

## 全文

Release: datasette 1.0a38 This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system. Site administrators who serve private tables in this way are advised to disable the execute-sql permission ` on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database. This fix is also available in Datasette 0.65.3. Thankfully this particular configuration - private tables and public tables exposed for the same database within the same instance - is likely to be rare. I've not encountered an instance like that myself. Tags: security, sql-injection, datasette

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_51cad51790e43db7a135192f