proomt

Search

Search posts, papers, and topics

All posts

Simon Willison1 min readrelease notesintermediate

datasette 0.65.5

Summary

Datasette 0.65.5 releases with a security fix: a trailing newline in a table name could bypass permissions and expose private rows (GHSA‑h547‑rmjf‑5m2m).

  • A newline character appended to a requested table name could be used to circumvent table‑level ACLs.
  • The issue was reported by a community member (dpfkdlemtp) and patched in this minor version.
  • Upgrade to 0.65.5 if you run Datasette in any environment where table permissions matter.

Permission bypasses can leak sensitive data from published datasets; the fix restores the intended isolation guarantees of Datasette's table‑level permissions.

4/10

Related reading

  1. datasette 1.0a40

    Datasette 1.0a40 adds a background‑task API (datasette.add_background_task()), switches the internal HTTP client to httpx2, and ships a batch of bug fixes aimed at stabilising the upcoming 1.0 release. The security fix mirrors that of 0.65.5.

    Simon Willisonsimonwillison.net1 minrelease
  2. datasette-explain 0.2.2

    datasette-explain 0.2.2 is a minor update for a Datasette plugin that provides SQL query explanation and validation. The primary enhancement is enabling explain plans on read-only stored-query pages.

    Simon Willisonsimonwillison.net1 minrelease
  3. datasette-auth-github 1.0

    The datasette-auth-github plugin now reaches 1.0, fixing a bug where cookies lacked a Max‑Age attribute and thus expired at session end. The fix ensures longer‑lasting sessions and the release is tested against recent Datasette versions.

    Simon Willisonsimonwillison.net1 minrelease
  4. September 16, 2026 security incident: how we responded to a LiteSpeed zero-day attack

    Hostinger detected a zero‑day exploit in LiteSpeed Web Server on a Brazil server on Sep 16 2026, giving the attacker root access and compromising 399 accounts. The team isolated the server, coordinated with LiteSpeed to patch the vulnerability, rolled out the fix fleet‑wide, and restored affected sites from backups within the same day.

    Hostingerhostinger.com2 minpostmortem