Platform
python
Component
django-select2
Fixed in
8.4.2
8.4.1
CVE-2025-48383 is a high-severity vulnerability affecting versions of django-select2 up to 8.4.0. This vulnerability allows for the potential leakage of access tokens, which could lead to unauthorized access to restricted querysets and sensitive data. The issue is patched in version 8.4.1 and later, and workarounds are available for specific deployment scenarios.
The core of this vulnerability lies within the HeavySelect2Mixin and its subclasses, such as ModelSelect2MultipleWidget and ModelSelect2Widget. An attacker can potentially exploit this flaw to access restricted querysets and data by leveraging the leakage of access tokens across requests. This could involve gaining unauthorized access to sensitive information, manipulating data, or even escalating privileges within the application. The impact is particularly severe in environments where access tokens are used to control access to critical resources or data.
This CVE was publicly disclosed on 2025-05-27. No public proof-of-concept (PoC) code has been released at the time of writing. The vulnerability's impact is dependent on specific deployment patterns and access token management practices, making widespread exploitation less likely without targeted attacks. It is not currently listed on CISA KEV.
Exploit Status
EPSS
0.29% (52% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-48383 is to upgrade to django-select2 version 8.4.1 or a later version, which contains the fix. If upgrading is not immediately feasible, a workaround exists for cases where widget instances are created during application loading, rather than during a request. Carefully review your code to identify any instances where widgets are initialized during app loading and implement appropriate access controls to prevent token leakage. Consider implementing stricter access control policies and regularly auditing your application for potential vulnerabilities.
Update the django-select2 library to version 8.4.1 or higher. This will fix the secret access token leakage vulnerability. You can update using pip: `pip install django-select2==8.4.1`.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-48383 is a high-severity vulnerability in django-select2 versions up to 8.4.0 that allows access tokens to be leaked, potentially granting unauthorized access to data.
You are affected if you are using django-select2 version 8.4.0 or earlier and your application initializes widgets during app loading.
Upgrade to django-select2 version 8.4.1 or later. If upgrading is not possible, implement workarounds to prevent token leakage during app loading.
There is no confirmed active exploitation of CVE-2025-48383 at this time, but the potential for exploitation exists.
Refer to the django-select2 project's official documentation and release notes for details on this vulnerability and the available fix.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.