CVE-2025-64481
Low
Description
Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slash is required) will redirect the user to https://example.com/foo/bar. This problem has been patched in both Datasette 0.65.2 and 1.0a21. To workaround this issue, if Datasette is running behind a proxy, that proxy could be configured to replace // with / in incoming request URLs.
SeverityLow
CVSS2.7
Exploit probability—
ProductDatasette
PublishedNov 7, 2025
First seenNov 7, 2025
Weakness typeCWE-601Open redirect
How to fix
Update
- datasette0.65.2, 1.0a21 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| datasettePyPI | v < 0.65.2, 1.0a0 ≤ v < 1.0a21, No range specified | 0.65.2, 1.0a21 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.