GHSA-74hv-qjjq-h7g5 datasette-graphql leaks details of the schema of private database files
- Exploited in the wild
- Not known
- Fix
- Available
What is GHSA-74hv-qjjq-h7g5?
GHSA-74hv-qjjq-h7g5 is a vulnerability in datasette-graphql, published on 24 Nov 2020.
Official description
Impact
When running against a Datasette instance with private databases, datasette-graphql would expose the schema of those database tables - but not the table contents.
Patches
Patched in version 1.2.
Workarounds
This issue is only present if a Datasette instance that includes private databases and has the datasette-graphql plugin installed is available on the public internet. Uninstalling the datasette-graphql plugin or preventing public access to the instance can workaround this issue.
For more information
If you have any questions or comments about this advisory:
- Open an issue in datasette-graphql
- Contact @simonw by Twitter direct message
Which versions are affected by GHSA-74hv-qjjq-h7g5?
2 open source packages ship an affected version, including datasette-graphql.
| Package | Affected | Fixed in |
|---|---|---|
datasette-graphql PyPI | All versions | 1.2 |
datasette-graphql PyPI | All versions | 1.2 |
How do I fix GHSA-74hv-qjjq-h7g5?
Upgrade datasette-graphql to 1.2 or later.
Is GHSA-74hv-qjjq-h7g5 being exploited?
There is no known exploitation of GHSA-74hv-qjjq-h7g5 in the wild and no public exploit code.