GHSA-74hv-qjjq-h7g5: 
Python vulnerability analysis and mitigation

The vulnerability (GHSA-74hv-qjjq-h7g5) affects datasette-graphql, a plugin for Datasette that provides GraphQL API functionality. The issue was discovered and disclosed on November 21, 2020, affecting versions below 1.2. The vulnerability allows exposure of private database table schemas in Datasette instances, though not the actual table contents (GitHub Advisory).

The vulnerability is classified as CWE-200 (Information Exposure) with a Low severity rating. When running against a Datasette instance with private databases, the datasette-graphql plugin would inadvertently expose the schema information of private database tables, although the actual content of these tables remained protected (GitHub Advisory).

The impact of this vulnerability is limited to the exposure of database schema information for private databases. While attackers could gain insight into the structure of private database tables, they would not be able to access the actual data within these tables (GitHub Advisory).

The vulnerability is only exploitable when a Datasette instance with private databases and the datasette-graphql plugin is accessible on the public internet (GitHub Advisory).

The vulnerability has been patched in version 1.2 of datasette-graphql. For users unable to update immediately, two workarounds are available: uninstalling the datasette-graphql plugin or preventing public access to the Datasette instance (GitHub Advisory).