GitHub Advisoryadvisory · PyPI
GHSA-w832-gg5g-x44m Open redirect endpoint in Datasette
LOW
Official page ↗
- Aliases
- CVE-2025-64481
- Ecosystem
- PyPI
- Packages
- datasette
- Severity
- Low
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
- Weaknesses
- CWE-601
- Reviewed
- 2025-11-06
Affected packages
• PyPI datasette: < 0.65.2 → fixed in 0.65.2
• PyPI datasette: >= 1.0a0, < 1.0a21 → fixed in 1.0a21
Description
Impact
Deployed instances of Datasette prior to `0.65.2` and `1.0a21` include an open redirect vulnerability.
Hits to the path `//example.com/foo/bar/` (the trailing slash is required) will redirect the user to `https://example.com/foo/bar`.
Patches
This problem has been patched in both Datasette `0.65.2` and `1.0a21`.
Workarounds
If Datasette is running behind a proxy that proxy could be configured to replace `//` with `/` in incoming request URLs.
Related
Alias · CVE (1)
- CVE-2025-64481 Datasette is an open source multi-tool for exploring and publishing data. vulnerability
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness
References
- https://github.com/simonw/datasette/security/advisories/GHSA-w832-gg5g-x44m web
- https://nvd.nist.gov/vuln/detail/CVE-2025-64481 advisory
- https://github.com/simonw/datasette/issues/2429 web
- https://github.com/simonw/datasette/commit/f257ca6edb64848c3b04b54d41e347c54fe57c05 web
- https://github.com/pypa/advisory-database/tree/main/vulns/datasette/PYSEC-2025-73.yaml web
- https://github.com/simonw/datasette package