datasette 1.0a38

Datasette 1.0a38, released on 6th August 2026, is an open-source multi-tool for exploring and publishing data. This release addresses a SQL injection security vulnerability that impacts instances where public and private tables are served in the same database, with access controlled by the Datasette permissions system. The flaw could allow users with access to public tables to execute SQL injection attacks, granting read-only access to private data. Site administrators are advised to disable the 'execute-sql' permission on affected databases. The fix is also available in Datasette 0.65.3. The configuration is noted as rare.