CVE-2025-64481: 
Python vulnerability analysis and mitigation

CVE-2025-64481 is an open redirect vulnerability (CWE-601) in Datasette, an open-source multi-tool for exploring and publishing data. It affects Datasette versions 0.65.1 and below, and alpha versions 1.0a0 through 1.0a19. The vulnerability was originally reported on September 17, 2024 (GitHub issue #2429), with the security advisory published on November 5, 2025, and the CVE assigned on November 7, 2025. It carries a CVSS v4.0 base score of 2.7 (Low) (GitHub Advisory, Feedly).

The root cause is improper handling of URL paths with double leading slashes in Datasette's 404 error handler (handle_404 in datasette/app.py). When a request path ends with a trailing slash, the handler strips the slash and issues a 302 redirect — but if the path begins with //, the redirect target is interpreted by browsers and HTTP clients as a protocol-relative URL pointing to an external host (e.g., a request to https://my-site//example.com/foo/bar/ redirects to https://example.com/foo/bar). The fix applied a regular expression (re.sub(rb"^/+", b"/", path)) to collapse multiple leading slashes into a single slash before redirecting (GitHub Commit, GitHub Issue). No authentication or special privileges are required to trigger the redirect, and no user interaction beyond clicking a crafted link is needed.

The primary risk of this vulnerability is its use as a vector for phishing and social engineering attacks, where an attacker crafts a URL that appears to point to a trusted Datasette instance but silently redirects victims to an attacker-controlled external site. There is no direct confidentiality, integrity, or availability impact on the Datasette server itself, and no lateral movement or data exfiltration is enabled by the redirect alone. The practical risk is limited to scenarios where users trust the originating domain and follow links without inspecting the final destination (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability requires no authentication and no user interaction on the server side, but does require a victim to follow a crafted link. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Identify a target Datasette instance: Locate a publicly accessible Datasette deployment running a vulnerable version (≤0.65.1 or 1.0a0–1.0a19) using search engines, Shodan, or direct knowledge of the deployment.
2. Craft a malicious URL: Construct a URL in the format https://<datasette-host>//<attacker-domain>/path/ — note the double slash after the host and the required trailing slash (e.g., https://data.example.org//evil.com/login/).
3. Deliver the link to a victim: Send the crafted URL to a target via email, chat, or embed it in content, leveraging the trusted appearance of the legitimate Datasette domain.
4. Victim follows the link: When the victim's browser or HTTP client requests the crafted path, Datasette's 404 handler strips the trailing slash and issues a 302 redirect to //evil.com/login, which browsers interpret as https://evil.com/login.
5. Victim lands on attacker-controlled site: The victim is transparently redirected to the attacker's site, which may mimic the original Datasette interface or a login page to harvest credentials (GitHub Advisory, GitHub Commit).

• Network: HTTP requests to a Datasette instance with paths beginning with // followed by an external domain (e.g., GET //attacker.com/path/ HTTP/1.1); 302 redirect responses from the Datasette server pointing to external domains not owned by the organization.
• Logs: Web server or application access logs showing requests matching the pattern ^//[a-zA-Z0-9.-]+/.*/$ with a trailing slash; corresponding 302 responses with Location: headers pointing to external hosts.
• Proxy/WAF: Outbound redirect traffic from the Datasette host to unexpected external domains following requests with double-slash paths.

Upgrade Datasette to version 0.65.2 (stable) or 1.0a21 (alpha) or later, which include the fix that normalizes multiple leading slashes in redirect paths (GitHub Advisory). As a temporary workaround for deployments that cannot be immediately upgraded, configure any reverse proxy (e.g., nginx, Apache, Caddy) sitting in front of Datasette to rewrite incoming request URLs by replacing // with / before forwarding to the application. No additional configuration changes within Datasette itself are available as a workaround.

The vulnerability was credited to researcher jamesjefferies, who also submitted the fix (GitHub Advisory). The issue was originally filed as a bug report by user psd in September 2024 and tracked for over a year before a formal security advisory was issued. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability database indexing.