{"id":"CVE-2025-48383","aliases":["GHSA-wjrh-hj83-3wh7","PYSEC-2026-1300"],"title":"Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking","summary":"Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","vendor":"django-select2","product":"django-select2","ecosystem":"pip","affected":["django-select2 < 8.4.1"],"patched":["django-select2 8.4.1"],"published":"2025-05-27","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:24.751328727Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wjrh-hj83-3wh7","references":[{"url":"https://github.com/codingjoe/django-select2/security/advisories/GHSA-wjrh-hj83-3wh7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48383"},{"url":"https://github.com/codingjoe/django-select2/commit/e5f41e6edba004d35f94915ff5e2559f44853412"},{"url":"https://github.com/codingjoe/django-select2"}],"tags":["osv","pip"],"epss":0.00312,"epssPercentile":0.24214,"ingestedAt":"2026-07-08T18:25:53.835Z","slug":"CVE-2025-48383","body":"## Overview\n\n### Impact\n\nInstances of `HeavySelect2Mixin` subclasses like the `ModelSelect2MultipleWidget` and `ModelSelect2Widget` can secret access tokens across requests. This can allow users to access restricted querysets and restricted data.\n\n### Patches\n\nThe problem has been patched in version 8.4.1 and all following versions.\n\n### Workarounds\n\nThis vulnerability is limited use cases where instances of widget classes are created during app loading (not during a request).\n\nExample of affected code:\n```python\nclass MyForm(forms.ModelForm):\n    class Meta:\n        widgets = {\"my_select_field\": Select2ModelWidget()}\n```\n\nDjango allows you to pass just the widget class (not the instance). This can be used to mitigate the session request leak.\n\nExample of affected code:\n```python\nclass MyForm(forms.ModelForm):\n    class Meta:\n        widgets = {\"my_select_field\": Select2ModelWidget}\n```\n\n\n\n### References\n\nThanks to @neartik for reporting this issue. I will address it later. I had to delete your issue, to avoid exploitation of this security issue.\n\n## Affected packages\n\n- `django-select2 < 8.4.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `django-select2 8.4.1`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}