Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking
Priority MEDIUM 42CWE-402Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data. This issue has been patched in version 8.4.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00325 25th percentileScored 2026-11-07
Fix Fixed django-select2 (codingjoe): 8.4.1django-select2 (PyPI): 8.4.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| codingjoe | django-select2 | before 8.4.1 | 8.4.1 | Patch available | CNA |
| — | django-select2 (PyPI) | before 8.4.1 | 8.4.1 | Patch available | GHSA-wjrh-hj83-3wh7 |
- django-select2 Vendorcodingjoe Affected before 8.4.1 Fixed in 8.4.1 Patch available CNA
- django-select2 (PyPI) Vendor— Affected before 8.4.1 Fixed in 8.4.1 Patch available GHSA-wjrh-hj83-3wh7
Remediation
- Fix · CNA django-select2 (codingjoe) Fixed in 8.4.1
- Fix · GHSA-wjrh-hj83-3wh7 django-select2 (PyPI) Fixed in 8.4.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-48383
- 2026-10-03 Alias added: GHSA-wjrh-hj83-3wh7
References
More codingjoe vulnerabilities
- TI-2026-30517 django-s3file: Relative path traversal CVSS 4.0CRITICAL 9.9
Sources
- CVE-2025-48383 · CVE Program
- CVE-2025-48383 · NVD
- FIRST EPSS
- GHSA-wjrh-hj83-3wh7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences