{"id":"CVE-2021-32670","aliases":["GHSA-xw7c-jx9m-xh5g","GHSA-gff3-739c-gxfq","PYSEC-2021-89"],"title":"Reflected cross-site scripting issue in Datasette","summary":"Reflected cross-site scripting issue in Datasette","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","vendor":"datasette","product":"datasette","ecosystem":"pip","affected":["datasette < 0.56.1"],"patched":["datasette 0.56.1"],"published":"2021-06-07","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-xw7c-jx9m-xh5g","references":[{"url":"https://github.com/simonw/datasette/security/advisories/GHSA-xw7c-jx9m-xh5g"},{"url":"https://github.com/simonw/datasette/issues/1360"},{"url":"https://datasette.io/plugins/datasette-auth-passwords"},{"url":"https://github.com/advisories/GHSA-gff3-739c-gxfq"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/datasette/PYSEC-2021-89.yaml"},{"url":"https://github.com/simonw/datasette"},{"url":"https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks"},{"url":"https://pypi.org/project/datasette"}],"tags":["osv","pip"],"epss":0.0096,"epssPercentile":0.6003,"ingestedAt":"2026-07-08T18:25:54.697Z","slug":"CVE-2021-32670","body":"## Overview\n\n### Impact\n\nThe `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability.\n\nThis vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data.\n\n### Patches\n\nDatasette 0.57 and 0.56.1 both include patches for this issue.\n\n### Workarounds\n\nIf you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.\n\n### References\n\n- [OWASP guide to reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks)\n- [Datasette issue #1360](https://github.com/simonw/datasette/issues/1360)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a discussion in [simonw/datasette](https://github.com/simonw/datasette/discussions)\n* Email us at `swillison+datasette @ gmail.com`\n\n\n## Affected packages\n\n- `datasette < 0.56.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `datasette 0.56.1`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}