CVE-2025-64481: 
Python vulnerability analysis and mitigation

CVE-2025-64481 affects Datasette, an open source multi-tool for exploring and publishing data. The vulnerability was discovered in versions 0.65.1 and below, as well as versions 1.0a0 through 1.0a19, where deployed instances contain an open redirect vulnerability. The issue was disclosed on November 5, 2025, and has been patched in versions 0.65.2 and 1.0a21 (GitHub Advisory).

The vulnerability is classified as an open redirect vulnerability (CWE-601). When users access a path with a specific pattern //example.com/foo/bar/ (requiring a trailing slash), the application redirects them to https://example.com/foo/bar. The vulnerability has been assigned a CVSS v3.1 base score of 0.0 (NONE) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N (GitHub Advisory).

The vulnerability could be exploited to facilitate phishing attacks by redirecting users to untrusted external sites. This type of vulnerability simplifies phishing attacks by allowing attackers to leverage the trust associated with the vulnerable domain (GitHub Advisory).

The vulnerability has been patched in Datasette versions 0.65.2 and 1.0a21. For users unable to update immediately, a workaround exists where if Datasette is running behind a proxy, that proxy can be configured to replace // with / in incoming request URLs (GitHub Advisory).