Skip to content
OpenAdvisories

Package · PyPI

datasette

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Low 2.7
    CVE-2025-64481

    Open redirect endpoint in Datasette

    Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasette include an open redirect vulnerability. Hits to the path //example.com/foo/bar/ (the trailing slas…

    simonw datasette datasette PyPI
  • Medium 5.3
    CVE-2023-40570

    Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users

    Datasette is an open source multi-tool for exploring and publishing data. This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such …

    simonw datasette datasette PyPI
  • High 7.2
    CVE-2021-32670

    Reflected cross-site scripting issue in Datasette

    Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#ref…

    simonw datasette datasette PyPI
  • Medium 4.3
    GHSA-q6j3-c4wc-63vw

    CSRF tokens leaked in URL by canned query form

    ### Impact The HTML form for a read-only canned query includes the hidden CSRF token field added in #798 for writable canned queries (#698). This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.dat…

    datasette PyPI