CVE-2025-64481 Open redirect endpoint in Datasette
Attackers can redirect users to malicious sites via crafted URLs in Datasette, potentially facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64481?
CVE-2025-64481 is a low-severity vulnerability in simonw datasette, published on 7 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slash is required) will redirect the user to https://example.com/foo/bar. This problem has been patched in both Datasette 0.65.2 and 1.0a21. To workaround this issue, if Datasette is running behind a proxy, that proxy could be configured to replace // with / in incoming request URLs.
Weakness: CWE-601
Which versions are affected by CVE-2025-64481?
5 open source packages ship an affected version, including datasette.
| Package | Affected | Fixed in |
|---|---|---|
datasette PyPI | All versions | None |
datasette PyPI | All versions | 0.65.2 |
datasette PyPI | All versions | 0.65.2 |
datasette PyPI | From 1.0a0 | 1.0a21 |
datasette PyPI | From 1.0a0 | 1.0a21 |
How do I fix CVE-2025-64481?
Upgrade datasette to a fixed version for your release line: 0.65.2 or 1.0a21.
Is CVE-2025-64481 being exploited?
There is no known exploitation of CVE-2025-64481 in the wild and no public exploit code.
Sources
Also known as GHSA-w832-gg5g-x44m, PYSEC-2025-73.