CVE-2025-48383

Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking

State: Published
Severity: 8.2 High
Published: May 27, 2025
Updated: May 27, 2025
Reserved: May 19, 2025

Description

Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data. This issue has been patched in version 8.4.1.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N	GitHub_M

Weaknesses

CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')
CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
django-select2codingjoe	< 8.4.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.