Read the docs
TI-2023-21369 Aliases CVE-2023-40570GHSA-7ch3-7pp7-7cpq

Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users

Priority LOW 31CWE-213Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as datasette-auth-passwords. The `/-/api` API explorer endpoint could reveal the names of both databases and tables - but not their contents - to an unauthenticated user. Datasette 1.0a4 has a fix for this issue. This will block access to the API explorer but will still allow access to the Datasette read or write JSON APIs, as those use different URL patterns within the Datasette `/database` hierarchy. This issue is patched in version 1.0a4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00555 46th percentileScored 2026-11-07
Fix Fixed datasette (simonw): 1.0a4datasette (PyPI): 1.0a4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
simonwdatasette1.0a0 to before 1.0a41.0a4Patch availableCNA
—datasette (PyPI)1.0a0 to before 1.0a41.0a4Patch availableGHSA-7ch3-7pp7-7cpq
  • datasette Vendorsimonw Affected 1.0a0 to before 1.0a4 Fixed in 1.0a4 Patch available CNA
  • datasette (PyPI) Vendor— Affected 1.0a0 to before 1.0a4 Fixed in 1.0a4 Patch available GHSA-7ch3-7pp7-7cpq

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:datasette:datasette:1.0:alpha0:*:*:*:*:*:*1.0 alpha0VulnerableDatasette
cpe:2.3:a:datasette:datasette:1.0:alpha1:*:*:*:*:*:*1.0 alpha1VulnerableDatasette
cpe:2.3:a:datasette:datasette:1.0:alpha2:*:*:*:*:*:*1.0 alpha2VulnerableDatasette
cpe:2.3:a:datasette:datasette:1.0:alpha3:*:*:*:*:*:*1.0 alpha3VulnerableDatasette
  • cpe:2.3:a:datasette:datasette:1.0:alpha0:*:*:*:*:*:* Versions 1.0 alpha0 Vulnerable ·Datasette
  • cpe:2.3:a:datasette:datasette:1.0:alpha1:*:*:*:*:*:* Versions 1.0 alpha1 Vulnerable ·Datasette
  • cpe:2.3:a:datasette:datasette:1.0:alpha2:*:*:*:*:*:* Versions 1.0 alpha2 Vulnerable ·Datasette
  • cpe:2.3:a:datasette:datasette:1.0:alpha3:*:*:*:*:*:* Versions 1.0 alpha3 Vulnerable ·Datasette

Remediation

  • Fix · CNA datasette (simonw) Fixed in 1.0a4
  • Fix · GHSA-7ch3-7pp7-7cpq datasette (PyPI) Fixed in 1.0a4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40570
  2. 2026-10-03 Alias added: GHSA-7ch3-7pp7-7cpq

References

Patch 1

Advisory 2

Other 2

  • TI-2025-39873 Open redirect endpoint in Datasette CVSS 4.0LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences