Summary & Key Takeaways ​

• Datasette 1.0a38 includes a critical SQL injection security fix.
• The vulnerability affects instances mixing public and private tables in the same database.
• Administrators are advised to disable the execute-sql permission for affected databases.
• The fix prevents unauthorized read-only access to private tables.
• A back-port of this fix is also available in Datasette 0.65.3.
• The specific vulnerable configuration is considered rare by the author.

Our Commentary ​

Security fixes are always paramount. While Simon notes this specific configuration is rare, it's a good reminder that even well-designed tools can have subtle vulnerabilities when used in complex ways. I appreciate the clear advice on mitigation.