GHSA-74hv-qjjq-h7g5
datasette-graphql leaks details of the schema of private database files
GHSA-74hv-qjjq-h7g5 is a vulnerability with no CVSS score yet in datasette-graphql, published November 24, 2020. No source lists public exploit code. Fixed in datasette-graphql 1.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.2datasette-graphql +1 more
Description
Impact
When running against a Datasette instance with private databases, datasette-graphql would expose the schema of those database tables - but not the table contents.
Patches
Patched in version 1.2.
Workarounds
This issue is only present if a Datasette instance that includes private databases and has the datasette-graphql plugin installed is available on the public internet. Uninstalling the datasette-graphql plugin or preventing public access to the instance can workaround this issue.
For more information
If you have any questions or comments about this advisory:
- Open an issue in datasette-graphql
- Contact @simonw by Twitter direct message
Affected packages
| Package | Affected | Fixed |
|---|---|---|
datasette-graphqlPyPI | before 1.2 | 1.2 |
datasette-graphqlPyPI | before 1.2, plus listed versions 0.100.110.120.12.10.12.2 Show 20 moreShow less0.12.30.130.140.150.1a00.1a10.1a20.1a30.1a40.20.30.40.50.60.70.80.91.01.0.11.1 | 1.2 |
What each source reports
GitHub AdvisoriesNo score
datasette-graphql leaks details of the schema of private database files
Impact
When running against a Datasette instance with private databases, datasette-graphql would expose the schema of those database tables - but not the table contents.
Patches
Patched in version 1.2.
Workarounds
This issue is only present if a Datasette instance that includes private databases and has the datasette-graphql plugin installed is available on the public internet. Uninstalling the datasette-graphql plugin or preventing public access to the instance can workaround this issue.
For more information
If you have any questions or comments about this advisory:
- Open an issue in datasette-graphql
- Contact @simonw by Twitter direct message
- Record
GHSA-74hv-qjjq-h7g5- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
datasette-graphql leaks details of the schema of private database files
Impact
When running against a Datasette instance with private databases, datasette-graphql would expose the schema of those database tables - but not the table contents.
Patches
Patched in version 1.2.
Workarounds
This issue is only present if a Datasette instance that includes private databases and has the datasette-graphql plugin installed is available on the public internet. Uninstalling the datasette-graphql plugin or preventing public access to the instance can workaround this issue.
For more information
If you have any questions or comments about this advisory:
- Open an issue in datasette-graphql
- Contact @simonw by Twitter direct message
- Record
GHSA-74hv-qjjq-h7g5- Weakness
- CWE-200
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.