datasette-graphql leaks details of the schema of private database files
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-200.
Summary
### Impact When running against a Datasette instance with private databases, `datasette-graphql` would expose the schema of those database tables - but not the table contents. ### Patches Patched in version 1.2. ### Workarounds This issue is only present if a Datasette instance that includes private databases and has the `datasette-graphql` plugin installed is available on the public internet. Uninstalling the `datasette-graphql` plugin or preventing public access to the instance can workaround this issue. ### For more information If you have any questions or comments about this advisory: * Open an issue in [datasette-graphql](https://github.com/simonw/datasette-graphql) * Contact [@simonw](https://twitter.com/simonw) by Twitter direct message
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | datasette-graphql (PyPI) | before 1.2 | 1.2 | Patch available | GHSA-74hv-qjjq-h7g5 |
- datasette-graphql (PyPI) Vendor— Affected before 1.2 Fixed in 1.2 Patch available GHSA-74hv-qjjq-h7g5
Remediation
- Fix · GHSA-74hv-qjjq-h7g5 datasette-graphql (PyPI) Fixed in 1.2 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-74hv-qjjq-h7g5
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences