Datasette 0.65.5 Fixes Security Flaw Exposing Private Rows

Simon Willison has released Datasette version 0.65.5, a crucial security update for the popular open-source multi-tool used for exploring and publishing data. This release addresses a specific vulnerability that allowed users to bypass table permissions and view private database rows.

The security flaw, documented under the advisory GHSA-h547-rmjf-5m2m, was identified and reported to the project by a contributor using the handle dpfkdlemtp. The issue involves a parsing oversight where a trailing newline character in a requested table name could trick the application into bypassing access controls, thereby exposing restricted data.

For database administrators and data journalists who deploy Datasette to share datasets publicly while keeping certain tables private, this vulnerability poses a direct risk. Upgrading to version 0.65.5 resolves the input validation issue, ensuring that table-level permissions are strictly enforced even when faced with malformed requests. Practitioners are urged to update their installations immediately to secure their private data.