PyPI/datasette CVE-2021-32670: unknown, EPSS 0.96%
Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site
Action: Upgrade datasette to 0.56.1 or later.
pip install datasette==0.56.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.56.1 | - |
Fixed versions
| 0.56.1 |
Sources
- osv: PYSEC-2021-89
- https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks
- https://pypi.org/project/datasette/
- https://datasette.io/plugins/datasette-auth-passwords
- https://github.com/simonw/datasette/security/advisories/GHSA-xw7c-jx9m-xh5g
- https://github.com/simonw/datasette/issues/1360
- https://github.com/advisories/GHSA-gff3-739c-gxfq
CVE-2021-32670 · published · modified · JSON