GHSA-w832-gg5g-x44mLow

Open redirect endpoint in Datasette

Published
November 6, 2025
Last Modified
May 19, 2026

🔗 CVE IDs covered (1)

📋 Description

### Impact Deployed instances of Datasette prior to `0.65.2` and `1.0a21` include an open redirect vulnerability. Hits to the path `//example.com/foo/bar/` (the trailing slash is required) will redirect the user to `https://example.com/foo/bar`. ### Patches This problem has been patched in both Datasette `0.65.2` and `1.0a21`. ### Workarounds If Datasette is running behind a proxy that proxy could be configured to replace `//` with `/` in incoming request URLs.

🎯 Affected products2

  • pip/datasette:< 0.65.2
  • pip/datasette:>= 1.0a0, < 1.0a20

🔗 References (6)