CVE-2025-48383High· 8.2▾ TwilightDjango-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
0.3% → 0.3%
Last analysed / modified upstream
Instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can secret access tokens across requests. This can allow users to access restricted querysets and restricted data.
The problem has been patched in version 8.4.1 and all following versions.
This vulnerability is limited use cases where instances of widget classes are created during app loading (not during a request).
Example of affected code:
class MyForm(forms.ModelForm):
class Meta:
widgets = {"my_select_field": Select2ModelWidget()}
Django allows you to pass just the widget class (not the instance). This can be used to mitigate the session request leak.
Example of affected code:
class MyForm(forms.ModelForm):
class Meta:
widgets = {"my_select_field": Select2ModelWidget}
Thanks to @neartik for reporting this issue. I will address it later. I had to delete your issue, to avoid exploitation of this security issue.
django-select2 < 8.4.1Upgrade to a patched release:
django-select2 8.4.1