Release: datasette 1.0a38
Simon Willison’s Weblog
Subscribe
6th August 2026
Release
datasette 1.0a38 — An open source multi-tool for exploring and publishing data
This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system.
Site administrators who serve private tables in this way are advised to disable the execute-sql permission ` on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database.
This fix is also available in Datasette 0.65.3.
Thankfully this particular configuration - private tables and public tables exposed for the same database within the same instance - is likely to be rare. I've not encountered an instance like that myself.
Recent articles
One-shotting a Raccoon Heist game using Claude Fable 5 - 5th August 2026
New release of LLM adds support for reasoning traces, OpenAI Responses, server-side tools, and smarter logging - 4th August 2026
Stateless MCP has recaptured my interest (and inspired mcp-explorer and datasette-mcp) - 31st July 2026
This is a beat by Simon Willison, posted on 6th August 2026.
security 624
sql-injection 19
datasette 1,533
Monthly briefing
Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.
Pay me to send you less!
Sponsor & subscribe
Disclosures
Colophon
©
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026