{"id":"CVE-2025-48383","aliases":["GHSA-wjrh-hj83-3wh7","PYSEC-2026-1300"],"url":"https://o3.security/vulnerability/CVE-2025-48383","summary":"Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking","details":"### Impact\n\nInstances of `HeavySelect2Mixin` subclasses like the `ModelSelect2MultipleWidget` and `ModelSelect2Widget` can secret access tokens across requests. This can allow users to access restricted querysets and restricted data.\n\n### Patches\n\nThe problem has been patched in version 8.4.1 and all following versions.\n\n### Workarounds\n\nThis vulnerability is limited use cases where instances of widget classes are created during app loading (not during a request).\n\nExample of affected code:\n```python\nclass MyForm(forms.ModelForm):\n    class Meta:\n        widgets = {\"my_select_field\": Select2ModelWidget()}\n```\n\nDjango allows you to pass just the widget class (not the instance). This can be used to mitigate the session request leak.\n\nExample of affected code:\n```python\nclass MyForm(forms.ModelForm):\n    class Meta:\n        widgets = {\"my_select_field\": Select2ModelWidget}\n```\n\n\n\n### References\n\nThanks to @neartik for reporting this issue. I will address it later. I had to delete your issue, to avoid exploitation of this security issue.","published":"2025-05-27T15:03:10.062Z","modified":"2026-10-28T02:30:40.822715185Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"django-select2","fixedVersion":"8.4.1"}],"fix":{"url":"https://github.com/codingjoe/django-select2/commit/e5f41e6edba004d35f94915ff5e2559f44853412","label":"codingjoe/django-select2@e5f41e6"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48383.json"},{"type":"ADVISORY","url":"https://github.com/codingjoe/django-select2/security/advisories/GHSA-wjrh-hj83-3wh7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48383"},{"type":"FIX","url":"https://github.com/codingjoe/django-select2/commit/e5f41e6edba004d35f94915ff5e2559f44853412"},{"type":"PACKAGE","url":"https://github.com/codingjoe/django-select2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:40.822715185Z"}}