---
id: CVE-2025-48383
aliases:
  - GHSA-wjrh-hj83-3wh7
  - PYSEC-2026-1300
title: Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking
summary: Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
vendor: django-select2
product: django-select2
ecosystem: pip
affected:
  - django-select2 < 8.4.1
patched:
  - django-select2 8.4.1
published: '2025-05-27'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:24.751328727Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wjrh-hj83-3wh7'
references:
  - url: >-
      https://github.com/codingjoe/django-select2/security/advisories/GHSA-wjrh-hj83-3wh7
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-48383'
  - url: >-
      https://github.com/codingjoe/django-select2/commit/e5f41e6edba004d35f94915ff5e2559f44853412
  - url: 'https://github.com/codingjoe/django-select2'
tags:
  - osv
  - pip
epss: 0.00312
epssPercentile: 0.243
ingestedAt: '2026-07-08T18:25:53.835Z'
---

## Overview

### Impact

Instances of `HeavySelect2Mixin` subclasses like the `ModelSelect2MultipleWidget` and `ModelSelect2Widget` can secret access tokens across requests. This can allow users to access restricted querysets and restricted data.

### Patches

The problem has been patched in version 8.4.1 and all following versions.

### Workarounds

This vulnerability is limited use cases where instances of widget classes are created during app loading (not during a request).

Example of affected code:
```python
class MyForm(forms.ModelForm):
    class Meta:
        widgets = {"my_select_field": Select2ModelWidget()}
```

Django allows you to pass just the widget class (not the instance). This can be used to mitigate the session request leak.

Example of affected code:
```python
class MyForm(forms.ModelForm):
    class Meta:
        widgets = {"my_select_field": Select2ModelWidget}
```



### References

Thanks to @neartik for reporting this issue. I will address it later. I had to delete your issue, to avoid exploitation of this security issue.

## Affected packages

- `django-select2 < 8.4.1`

## Remediation

Upgrade to a patched release:

- `django-select2 8.4.1`