~ / search / GHSA-w832-gg5g-x44m

GHSA-w832-gg5g-x44m

Open redirect endpoint in Datasette

Source: GitHub Advisory Database (reviewed) Low CVE-2025-64481

Packages

EcosystemPackageAffectedFixed in
PyPI datasette < 0.65.2 0.65.2
PyPI datasette >= 1.0a0, < 1.0a21 1.0a21

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Deployed instances of Datasette prior to `0.65.2` and `1.0a21` include an open redirect vulnerability. Hits to the path `//example.com/foo/bar/` (the trailing slash is required) will redirect the user to `https://example.com/foo/bar`. ### Patches This problem has been patched in both Datasette `0.65.2` and `1.0a21`. ### Workarounds If Datasette is running behind a proxy that proxy could be configured to replace `//` with `/` in incoming request URLs.

References

External links from the advisory. They lead to third-party sites.