Datasette 1.0a38 has been released, addressing a critical SQL injection vulnerability. This fix is particularly important for instances that serve both public and private tables within the same database, where access is managed by Datasette’s permissions system.
Source: Simon Willison