Simon Willison1 min readrelease notesintermediate
datasette 0.65.5
Summary
Datasette 0.65.5 releases with a security fix: a trailing newline in a table name could bypass permissions and expose private rows (GHSA‑h547‑rmjf‑5m2m).
- A newline character appended to a requested table name could be used to circumvent table‑level ACLs.
- The issue was reported by a community member (dpfkdlemtp) and patched in this minor version.
- Upgrade to 0.65.5 if you run Datasette in any environment where table permissions matter.
Permission bypasses can leak sensitive data from published datasets; the fix restores the intended isolation guarantees of Datasette's table‑level permissions.
4/10
