{"id":"GHSA-74hv-qjjq-h7g5","aliases":[],"status":"published","title":"datasette-graphql leaks details of the schema of private database files","description":"### Impact\n\nWhen running against a Datasette instance with private databases, `datasette-graphql` would expose the schema of those database tables - but not the table contents.\n\n### Patches\n\nPatched in version 1.2.\n\n### Workarounds\n\nThis issue is only present if a Datasette instance that includes private databases and has the `datasette-graphql` plugin installed is available on the public internet. Uninstalling the `datasette-graphql` plugin or preventing public access to the instance can workaround this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [datasette-graphql](https://github.com/simonw/datasette-graphql)\n* Contact [@simonw](https://twitter.com/simonw) by Twitter direct message","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2020-11-24T22:59:08Z","modified":"2024-12-02T05:43:35Z","fixes":[{"ecosystem":"PyPI","package":"datasette-graphql","fixed_in":["1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"datasette-graphql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"datasette-graphql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2"}]}],"versions":["0.10","0.11","0.12","0.12.1","0.12.2","0.12.3","0.13","0.14","0.15","0.1a0","0.1a1","0.1a2","0.1a3","0.1a4","0.2","0.3","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.0.1","1.1"]}],"references":[{"url":"https://github.com/simonw/datasette-graphql/security/advisories/GHSA-74hv-qjjq-h7g5","tags":["web"]},{"url":"https://pypi.org/project/datasette-graphql/"},{"url":"https://github.com/advisories/GHSA-74hv-qjjq-h7g5"},{"url":"https://pypi.org/project/datasette-graphql","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-74hv-qjjq-h7g5","title":"datasette-graphql leaks details of the schema of private database files","description":"### Impact\n\nWhen running against a Datasette instance with private databases, `datasette-graphql` would expose the schema of those database tables - but not the table contents.\n\n### Patches\n\nPatched in version 1.2.\n\n### Workarounds\n\nThis issue is only present if a Datasette instance that includes private databases and has the `datasette-graphql` plugin installed is available on the public internet. Uninstalling the `datasette-graphql` plugin or preventing public access to the instance can workaround this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [datasette-graphql](https://github.com/simonw/datasette-graphql)\n* Contact [@simonw](https://twitter.com/simonw) by Twitter direct message","status":"published","published":"2020-11-24T22:59:08Z","modified":"2023-01-09T05:04:17Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:09.554044Z"}],"osv":[{"id":"GHSA-74hv-qjjq-h7g5","title":"datasette-graphql leaks details of the schema of private database files","description":"### Impact\n\nWhen running against a Datasette instance with private databases, `datasette-graphql` would expose the schema of those database tables - but not the table contents.\n\n### Patches\n\nPatched in version 1.2.\n\n### Workarounds\n\nThis issue is only present if a Datasette instance that includes private databases and has the `datasette-graphql` plugin installed is available on the public internet. Uninstalling the `datasette-graphql` plugin or preventing public access to the instance can workaround this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [datasette-graphql](https://github.com/simonw/datasette-graphql)\n* Contact [@simonw](https://twitter.com/simonw) by Twitter direct message","status":"published","published":"2020-11-24T22:59:08Z","modified":"2024-12-02T05:43:35.091839Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:40.308826Z"}]}}