PT-2025-45441 · Datasette · Datasette

Published 2025-11-06 · Updated 2025-12-26 · CVE-2025-64481

Positive Technologies (AI Summary)

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Datasette versions 0.65.1 and below Datasette versions 1.0a0 through 1.0a19

Description Datasette, an open source multi-tool for exploring and publishing data, contains an open redirect issue in deployed instances. Requests to paths like '//example.com/foo/bar/' with a trailing slash will redirect users to URLs such as 'https://example.com/foo/bar'.

Recommendations Update Datasette to version 0.65.2 or later. Update Datasette to version 1.0a21 or later. If updating is not immediately possible and Datasette is running behind a proxy, configure the proxy to replace '//' with '/' in incoming request URLs.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-64481

GHSA-W832-GG5G-X44M

PYSEC-2025-73

Affected Products

Datasette

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64481.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-64481 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w832-gg5g-x44m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64481 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-73 · Vendor Advisory
• https://github.com/simonw/datasette/security/advisories/GHSA-w832-gg5g-x44m · Note
• https://github.com/simonw/datasette/commit/f257ca6edb64848c3b04b54d41e347c54fe57c05 · Note
• https://github.com/simonw/datasette/issues/2429 · Note
• https://github.com/simonw/datasette · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/datasette/PYSEC-2025-73.yaml · Note
• https://t.me/cveNotify/146918 · Telegram Post
• https://t.me/CVEtracker/36812 · Telegram Post
• https://twitter.com/CVEnew/status/1986899285011829160 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1987059085137596798 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1oqv4uj/resumen_diario_de_vulnerabilidades_07112025 · Reddit Post