Datasette 0.65.5 and 1.0a40 patch table permission bypass tracked as GHSA-h547-rmjf-5m2m

Datasette 0.65.5 fixes a security issue (GHSA-h547-rmjf-5m2m) in which a trailing newline in a requested table name bypassed table permission checks and could expose private rows; the same fix ships in the 1.0a40 alpha, which also adds a background task…

On 2026-09-16, Simon Willison released Datasette 0.65.5 to address GHSA-h547-rmjf-5m2m, a permission bypass in which a trailing newline in a requested table name bypassed table permission checks and could expose private rows on affected Datasette instances. The flaw was reported by dpfkdlemtp. The same security fix is included in Datasette 1.0a40, an alpha on the road to a stable 1.0 release. Beyond the security fix, 1.0a40 introduces a datasette.add_background_task() method letting plugins launch and manage background tasks, migrates to httpx2 powering internal client methods such as datasette.client.get(), and carries many bug fixes resulting from issue triage ahead of the 1.0 stable release.

• Vulnerability tracked as GHSA-h547-rmjf-5m2m
• Trailing newline in a requested table name bypassed table permission checks
• The bypass could expose private rows on affected Datasette instances
• Reported by dpfkdlemtp
• Fix shipped in Datasette 0.65.5 (released 2026-09-16)
• The same security fix is included in Datasette 1.0a40
• 1.0a40 is an alpha release on the road to a stable 1.0