Skip to content
OpenAdvisories

Package · PyPI

datasette

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2023-40570

    Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users

    Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such …

    simonw datasette datasette PyPI
  • Medium 4.3
    GHSA-q6j3-c4wc-63vw

    CSRF tokens leaked in URL by canned query form

    ### Impact The HTML form for a read-only canned query includes the hidden CSRF token field added in #798 for writable canned queries (#698). This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.dat…

    datasette PyPI