{"id":"GHSA-74hv-qjjq-h7g5","summary":"datasette-graphql leaks details of the schema of private database files","details":"### Impact\n\nWhen running against a Datasette instance with private databases, `datasette-graphql` would expose the schema of those database tables - but not the table contents.\n\n### Patches\n\nPatched in version 1.2.\n\n### Workarounds\n\nThis issue is only present if a Datasette instance that includes private databases and has the `datasette-graphql` plugin installed is available on the public internet. Uninstalling the `datasette-graphql` plugin or preventing public access to the instance can workaround this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [datasette-graphql](https://github.com/simonw/datasette-graphql)\n* Contact [@simonw](https://twitter.com/simonw) by Twitter direct message","modified":"2024-12-02T05:43:35.091839Z","published":"2020-11-24T22:59:08Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2020-11-24T21:42:40Z","nvd_published_at":null,"cwe_ids":["CWE-200"],"severity":"LOW"},"references":[{"type":"WEB","url":"https://github.com/simonw/datasette-graphql/security/advisories/GHSA-74hv-qjjq-h7g5"},{"type":"WEB","url":"https://pypi.org/project/datasette-graphql"}],"affected":[{"package":{"name":"datasette-graphql","ecosystem":"PyPI","purl":"pkg:pypi/datasette-graphql"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2"}]}],"versions":["0.10","0.11","0.12","0.12.1","0.12.2","0.12.3","0.13","0.14","0.15","0.1a0","0.1a1","0.1a2","0.1a3","0.1a4","0.2","0.3","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.0.1","1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/11/GHSA-74hv-qjjq-h7g5/GHSA-74hv-qjjq-h7g5.json"}}],"schema_version":"1.9.0"}