CVE-2025-64481
Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slash is required) will redirect the user to https://example.com/foo/bar. This problem has been patched in both Datasette 0.65.2 and 1.0a21. To workaround this issue, if Datasette is running behind a proxy, that proxy could be configured to replace // with / in incoming request URLs.
- Affected products
- Datasette
- Fix
- Available
- CVSS 4.0
- 6.9 MEDIUM
- EPSS
- 0.4% (32th percentile)
- Weakness
- CWE-601
- NVD status
- Deferred
- Published
- 2025-11-07
No indexed exploits for CVE-2025-64481 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2025-64481 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.