GHSA-w832-gg5g-x44mLow
Open redirect endpoint in Datasette
🔗 CVE IDs covered (1)
📋 Description
### Impact
Deployed instances of Datasette prior to `0.65.2` and `1.0a21` include an open redirect vulnerability.
Hits to the path `//example.com/foo/bar/` (the trailing slash is required) will redirect the user to `https://example.com/foo/bar`.
### Patches
This problem has been patched in both Datasette `0.65.2` and `1.0a21`.
### Workarounds
If Datasette is running behind a proxy that proxy could be configured to replace `//` with `/` in incoming request URLs.
🎯 Affected products2
- pip/datasette:< 0.65.2
- pip/datasette:>= 1.0a0, < 1.0a20
🔗 References (6)
- https://github.com/simonw/datasette/security/advisories/GHSA-w832-gg5g-x44m
- https://github.com/simonw/datasette/issues/2429
- https://github.com/simonw/datasette/commit/f257ca6edb64848c3b04b54d41e347c54fe57c05
- https://nvd.nist.gov/vuln/detail/CVE-2025-64481
- https://github.com/pypa/advisory-database/tree/main/vulns/datasette/PYSEC-2025-73.yaml
- https://github.com/advisories/GHSA-w832-gg5g-x44m