Advisory Weakness Curation

datasette-graphql leaks details of the schema of private database files ### Impact When running against a Datasette instance with private databases, `datasette-graphql` would expose the schema of those database tables - but not the table contents. ### Patches Patched in version 1.2. ### Workarounds This issue is only present if a Datasette instance that includes private databases and has the `datasette-graphql` plugin installed is available on the public internet. Uninstalling the `datasette-graphql` plugin or preventing public access to the instance can workaround this issue. ### For more information If you have any questions or comments about this advisory: * Open an issue in datasette-graphql https://github.com/simonw/datasette-graphql * Contact @simonw https://twitter.com/simonw by Twitter direct message

datasette-graphql leaks details of the schema of private database files ### Impact When running against a Datasette instance with private databases, `datasette-graphql` would expose the schema of those database tables - but not the table contents. ### Patches Patched ### Workarounds This issue is only present if a Datasette instance that includes private databases and has the `datasette-graphql` plugin installed is available on the public internet. Uninstalling the `datasette-graphql` plugin or preventing public access to the instance can workaround this issue. ### For more information If you have any questions or comments about this advisory: * Open an issue in datasette-graphql https://github.com/simonw/datasette-graphql * Contact @simonw https://twitter.com/simonw by Twitter direct message