Low
Open redirect endpoint in Datasette
Type: advisorySources: OSV
Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slash is required) will redirect the user to https://example.com/foo/bar. This problem has been patched in both Datasette 0.65.2 and 1.0a21. To workaround this issue, if Datasette is running behind a proxy, that proxy could be configured to replace // with / in incoming request URLs.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-64481
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 21:03 UTC · Revision 1
Source evidence
Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slash is required) will redirect the user to https://example.com/foo/bar. This problem has been patched in both Datasette 0.65.2 and 1.0a21. To workaround this issue, if Datasette is running behind a proxy, that proxy could be configured to replace // with / in incoming request URLs.
osv:CVE-2025-64481
Complete source record
{
"id": "44a2ddbb8776c0c9fb55a7c5cf21a339f86d1b3c7821591b04d7830b0e3defec",
"url": "https://osv.dev/vulnerability/CVE-2025-64481",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Open redirect endpoint in Datasette",
"summary": "Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slash is required) will redirect the user to https://example.com/foo/bar. This problem has been patched in both Datasette 0.65.2 and 1.0a21. To workaround this issue, if Datasette is running behind a proxy, that proxy could be configured to replace // with / in incoming request URLs.",
"evidence": "osv:CVE-2025-64481",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2025-64481",
"aliases": [
"CVE-2025-64481",
"GHSA-w832-gg5g-x44m",
"PYSEC-2025-73"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/simonw/datasette",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "6a141467f9f8b05c84bc00c10e157962e3e43960"
},
{
"introduced": "4a0bd960e9763623dae6a13c8af3810c4ce9fb0a"
},
{
"fixed": "95a1fef28000d0b44ceaa398421530f588c5c385"
},
{
"fixed": "f257ca6edb64848c3b04b54d41e347c54fe57c05"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.65.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "1.0a0"
},
{
"fixed": "1.0a20"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "f257ca6edb64848c3b04b54d41e347c54fe57c05"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"0.65.1",
"1.0a19",
"1.0a18",
"1.0a17",
"0.65",
"0.64.8",
"1.0a16",
"1.0a15",
"1.0a14",
"0.64.7",
"0.64.6",
"1.0a13",
"1.0a12",
"1.0a11",
"1.0a10",
"1.0a9",
"1.0a8",
"0.64.5",
"0.64.4",
"1.0a6",
"0.64.3",
"1.0a5",
"1.0a4",
"1.0a3",
"0.64.2",
"0.64.1",
"0.64",
"0.63.3",
"0.63.2",
"1.0a2",
"1.0a1",
"1.0a0",
"0.63.1",
"0.63",
"0.63a1",
"0.63a0",
"0.62",
"0.62a1",
"0.62a0",
"0.61.1",
"0.61",
"0.61a0",
"0.60",
"0.60a1",
"0.60a0",
"0.59.4",
"0.59.3",
"0.59.2",
"0.59.1",
"0.59",
"0.59a2",
"0.59a1",
"0.59a0",
"0.58.1",
"0.58",
"0.58a1",
"0.58a0",
"0.57.1",
"0.57",
"0.56",
"0.57a1",
"0.57a0",
"0.55",
"0.54",
"0.54a0",
"0.53",
"0.52.4",
"0.52.3",
"0.52.2",
"0.52.1",
"0.52",
"0.51.1",
"0.51",
"0.51a2",
"0.51a1",
"0.51a0",
"0.50.2",
"0.50.1",
"0.50",
"0.50a1",
"0.50a0",
"0.49.1",
"0.49",
"0.49a1",
"0.49a0",
"0.48",
"0.47.3",
"0.47.2",
"0.47.1",
"0.47",
"0.46",
"0.45",
"0.45a5",
"0.45a4",
"0.45a3",
"0.45a2",
"0.45a1",
"0.45a0",
"0.44",
"0.43",
"0.42",
"0.41",
"0.40",
"0.39",
"0.38",
"0.37.1",
"0.37",
"0.36",
"0.35",
"0.34",
"0.33",
"0.32",
"0.31.2",
"0.31.1",
"0.31",
"0.30.2",
"0.30.1",
"0.30",
"0.29.3",
"0.29.2",
"0.29.1",
"0.29",
"0.28",
"0.27",
"0.26.2",
"0.26.1",
"0.26",
"0.25.2",
"0.25.1",
"0.25",
"0.24",
"0.23.2",
"0.23.1",
"0.23",
"0.22.1",
"0.22",
"0.21",
"0.20",
"0.19",
"0.18",
"0.17",
"0.16",
"0.15",
"0.14",
"0.13",
"0.12",
"0.11",
"0.10",
"0.9",
"0.8",
"0.7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64481.json"
}
}
],
"modified": "2026-10-28T02:30:23.831364297Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64481.json",
"https://github.com/simonw/datasette/security/advisories/GHSA-w832-gg5g-x44m",
"https://nvd.nist.gov/vuln/detail/CVE-2025-64481",
"https://github.com/simonw/datasette/issues/2429",
"https://github.com/simonw/datasette/commit/f257ca6edb64848c3b04b54d41e347c54fe57c05"
],
"provider_metadata": {
"cwe_ids": [
"CWE-601"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64481.json"
}
},
"related_cves": [
{
"value": "CVE-2025-64481",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 490043,
"published_at": "2025-11-07T20:35:39.827+00:00"
}