Skip to content
Fencer Intel
low —

GHSA-74hv-qjjq-h7g5 json

datasette-graphql leaks details of the schema of private database files

published 5y ago modified last yr.

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

When running against a Datasette instance with private databases, `datasette-graphql` would expose the schema of those database tables - but not the table contents.

### Patches

Patched in version 1.2.

### Workarounds

This issue is only present if a Datasette instance that includes private databases and has the `datasette-graphql` plugin installed is available on the public internet. Uninstalling the `datasette-graphql` plugin or preventing public access to the instance can workaround this issue.

### For more information If you have any questions or comments about this advisory: * Open an issue in [datasette-graphql](https://github.com/simonw/datasette-graphql) * Contact [@simonw](https://twitter.com/simonw) by Twitter direct message

Patch / fix

  • pypi datasette-graphql 1.2

Is GHSA-74hv-qjjq-h7g5 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
pypi datasette-graphql
<1.2
1.2

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.