CVE-2021-32670: Reflected cross-site scripting issue in Datasette

CVE-2021-32670 · Severity: low · CVSS 3.1 · Published 2021-06-07

Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.

Technologies: datasette (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2021-32670 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-32670 being exploited in the wild.
How severe is CVE-2021-32670?
Low severity, with a CVSS score of 3.1, published 7 June 2021.
Which products and versions are affected?
datasette (PyPI) ECOSYSTEM:introduced=0,fixed=0.56.1.
Is there a fix for CVE-2021-32670?
Yes. datasette (PyPI): upgrade to 0.56.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2021-32670?
Check whether you run datasette (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • datasette (PyPI): upgrade to 0.56.1 or later
    pip install "datasette>=0.56.1"

Affected products

  • datasette (PyPI) ECOSYSTEM:introduced=0,fixed=0.56.1

Identifiers

  • CVE-2021-32670
  • GHSA-gff3-739c-gxfq
  • GHSA-xw7c-jx9m-xh5g
  • PYSEC-2021-89

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.