Datasette 1.0a38 修复 SQL 注入漏洞

AI 摘要

Datasette 1.0a38 修复了一个 SQL 注入安全漏洞，该漏洞影响在同一数据库中同时提供公共和私有表、并使用 Datasette 权限系统配置访问的实例。管理员被建议禁用该数据库的 execute-sql 权限，以防止用户通过原始 SQL 查询访问私有表。此修复也适用于 Datasette 0.65.3。

正文节选

6th August 2026 This release fixes a SQL injection security issue that affects Datasette instances that serve a mixture of public and private tables in the same database, with access configured using the Datasette permissions system. Site administrators who serve private tables in this way are advised to disable the execute-sql permission ` on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed users with access to a

发布时间：2026-08-07 02:24

抓取时间：2026-08-07 04:51

来源机构：Simon Willison