# CVE-2021-32670: Reflected cross-site scripting issue in Datasette

Source: https://junglewise.ai/threats/cve-2021-32670-duplicate-advisory-reflected-cross-site-scripting-issue-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-06-07  
License: CC BY 4.0 with a link back

CVE-2021-32670 · Severity: low · CVSS 3.1 · Published 2021-06-07

Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.

Technologies: [datasette (PyPI)](https://junglewise.ai/threats/technologies/datasette). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2021-32670 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-32670 being exploited in the wild.

**How severe is CVE-2021-32670?** Low severity, with a CVSS score of 3.1, published 7 June 2021.

**Which products and versions are affected?** datasette (PyPI) ECOSYSTEM:introduced=0,fixed=0.56.1.

**Is there a fix for CVE-2021-32670?** Yes. datasette (PyPI): upgrade to 0.56.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2021-32670?** Check whether you run datasette (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- datasette (PyPI): upgrade to 0.56.1 or later

  ```sh
  pip install "datasette>=0.56.1"
  ```


## Affected products

- datasette (PyPI) ECOSYSTEM:introduced=0,fixed=0.56.1

## Identifiers

- CVE-2021-32670
- GHSA-gff3-739c-gxfq
- GHSA-xw7c-jx9m-xh5g
- PYSEC-2021-89

## Related threats

- [Datasette open redirect vulnerability](https://junglewise.ai/threats/cve-2025-64481-datasette-open-redirect-vulnerability)
- [Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users](https://junglewise.ai/threats/cve-2023-40570-datasette-1-0-alpha-series-leaks-names-of-databases-and-tables-to)
- [CSRF tokens leaked in URL by canned query form](https://junglewise.ai/threats/csrf-tokens-leaked-in-url-by-canned-query-form-3835c433)