https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T18:08:17.305173+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-datasette-cve-2021-32670 BREW-datasette-CVE-2021-32670 2026-10-06T18:08:17.841368+00:00

Affected: Homebrew: datasette

Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.

 https://cve.radiocsirt.org/vuln/cnvd-2021-40782 cnvd-2021-40782 2026-10-06T18:08:17.841456+00:00 cnvd-2021-40782 https://cve.radiocsirt.org/vuln/euvd-2026-28025 EUVD-2026-28025 2026-10-06T18:08:17.841485+00:00 EUVD-2026-28025 https://cve.radiocsirt.org/vuln/fkie_cve-2021-32670 fkie_cve-2021-32670 2026-10-06T18:08:17.841504+00:00

Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.

 https://cve.radiocsirt.org/vuln/ghsa-xw7c-jx9m-xh5g GHSA-xw7c-jx9m-xh5g — Reflected cross-site scripting issue in Datasette 2026-10-06T18:08:17.841545+00:00

Affected: PyPI: datasette

### Impact

The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability.

This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data.

### Patches

Datasette 0.57 and 0.56.1 both include patches for this issue.

### Workarounds

If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.

### References

- [OWASP guide to reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) - [Datasette issue #1360](https://github.com/simonw/datasette/issues/1360)

### For more information If you have any questions or comments about this advisory: * Open a discussion in [simonw/datasette](https://github.com/simonw/datasette/discussions) * Email us at `swillison+datasette @ gmail.com`

 https://cve.radiocsirt.org/vuln/gsd-2021-32670 gsd-2021-32670 2026-10-06T18:08:17.841602+00:00 gsd-2021-32670 https://cve.radiocsirt.org/vuln/pysec-2021-89 PYSEC-2021-89 2026-10-06T18:08:17.841621+00:00

Affected: PyPI: datasette

Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.