Approved changes feed: RSS · Atom
cpe:2.3:a:datasette:datasette:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Datasette (566631a8-4a54-5bc8-a985-14924fedbedd) |
|---|---|
| Product | Datasette (ddf197dc-9986-5bcc-87c4-42f8bcb9c741) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/simonw/datasette |
purl2cpe | 2026-06-01 10:10:55.037297 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-32670 |
vulnerable | 2026-06-08 05:32:07.803362 |
Reflected cross-site scripting issue in Datasette
HIGH (7.2)
Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.
Published: 2021-06-07T21:20:13.000Z
Updated: 2024-08-03T23:25:31.015Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.