low2.7
CVE-2025-64481
Open redirect endpoint in Datasette
Impact
### Impact Deployed instances of Datasette prior to `0.65.2` and `1.0a21` include an open redirect vulnerability. Hits to the path `//example.com/foo/bar/` (the trailing slash is required) will redirect the user to `https://example.com/foo/bar`. ### Patches This problem has been patched in both Datasette `0.65.2` and `1.0a21`. ### Workarounds If Datasette is running behind a proxy that proxy could be configured to replace `//` with `/` in incoming request URLs.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | datasette | < 0.65.2 | 0.65.2 |
Affected products
| Product | Affected versions |
|---|---|
| Versions 0.65.1 And Below And 1.0a0 | through 1.0a19 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/simonw/datasette/commit/f257ca6edb64848c3b04b54d41e347c54fe57c05
- https://github.com/simonw/datasette/issues/2429
- https://github.com/simonw/datasette/security/advisories/GHSA-w832-gg5g-x44m
- https://github.com/advisories/GHSA-w832-gg5g-x44m
- https://nvd.nist.gov/vuln/detail/CVE-2025-64481
- https://github.com/pypa/advisory-database/tree/main/vulns/datasette/PYSEC-2025-73.yaml