datasette-graphql leaks details of the schema of private database files
Impact
When running against a Datasette instance with private databases, datasette-graphql would expose the schema of those database tables - but not the table contents.
Patches
Patched in version 1.2.
Workarounds
This issue is only present if a Datasette instance that includes private databases and has the datasette-graphql plugin installed is available on the public internet. Uninstalling the datasette-graphql plugin or preventing public access to the instance can workaround this issue.
For more information
If you have any questions or comments about this advisory:
- Open an issue in datasette-graphql
- Contact @simonw by Twitter direct message
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | datasette-graphql | < 1.2 | 1.2 |
References
- Weakness (CWE)
CWE-200- Platform
- Python (PyPI)
- Package
datasette-graphql- Disclosed
- 24.11.2020
- Updated
- 11.10.2026 12:18
Sources and licenses
OSV / GitHub Advisory Database - GHSA-74hv-qjjq-h7g5 - CC BY 4.0
Vulnerability history: datasette-graphql
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.