CVE-2025-64481
lowpriority · track · 0EPSS 0.004 · 35 %ileEUUSEPSS · scored 2026-10-27
Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slash is required) will redirect the user to https://example.com/foo/bar. This problem has been patched in both Datasette 0.65.2 and 1.0a21. To workaround this issue, if Datasette is running behind a proxy, that proxy could be configured to replace // with / in incoming request URLs.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-w832-gg5g-x44mOpen redirect endpoint in Datasette2025-11-06ghsa · osvUS
### Impact Deployed instances of Datasette prior to `0.65.2` and `1.0a21` include an open redirect vulnerability. Hits to the path `//example.com/foo/bar/` (the trailing slash is required) will redirect the user to `https://example.com/foo/bar`. ### Patches This problem has been patched in both Datasette `0.65.2` and `1.0a21`. ### Workarounds If Datasette is running behind a proxy that proxy could be configured to replace `//` with `/` in incoming request URLs.
- PYSEC-2025-732025-11-07vendor · osvUS
Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slash is required) will redirect the user to https://example.com/foo/bar. This problem has been patched in both Datasette 0.65.2 and 1.0a21. To workaround this issue, if Datasette is running behind a proxy, that proxy could be configured to replace // with / in incoming request URLs.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-64481cnnvd
- https://github.com/simonw/datasette/commit/f257ca6edb64848c3b04b54d41e347c54fe57c05cnnvd
- https://github.com/simonw/datasette/issues/2429cnnvd
- https://github.com/simonw/datasette/releasesPatchcnnvd
- https://github.com/simonw/datasette/security/advisories/GHSA-w832-gg5g-x44mcnnvd
- https://github.com/simonw/datasette/commit/f257ca6edb64848c3b04b54d41e347c54fe57c05enisa_euvd
- https://github.com/simonw/datasette/issues/2429enisa_euvd
- https://github.com/simonw/datasette/security/advisories/GHSA-w832-gg5g-x44menisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan