AIKIDO-2026-596736
datasette is vulnerable to SQL Injection
75
High Risk
This Affects:
datasetteTL;DR
Datasette converts query-string table filter parameters into SQL WHERE clauses using several built-in filters. These filters build SQL without safely quoting table and column identifiers derived from user-controlled parameters, so crafted identifiers can break out of quoting and inject SQL. A user able to view any single table in a database can bypass table-level permissions and read data from other restricted tables in the same database, even when the execute-sql permission is denied. The fix safely quotes identifiers with _quote_sqlite_identifier() and escape_sqlite(), including names containing closing brackets or quotes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
datasette is vulnerable to SQL Injection in versions 0.0.1 - 0.65.2.
How to fix this
Upgrade the datasette library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant