Django-Select2 Vulnerável a Vazamento da Chave de Cache Secreta da Instância do Widget

The core of this vulnerability lies within the HeavySelect2Mixin and its subclasses, such as ModelSelect2MultipleWidget and ModelSelect2Widget. An attacker can potentially exploit this flaw to access restricted querysets and data by leveraging the leakage of access tokens across requests. This could involve gaining unauthorized access to sensitive information, manipulating data, or even escalating privileges within the application. The impact is particularly severe in environments where access tokens are used to control access to critical resources or data.

Applications using django-select2 versions 8.4.0 and earlier are at risk, particularly those that rely on access tokens for authorization and where widgets are initialized during application loading. Shared hosting environments utilizing vulnerable versions of django-select2 are also at increased risk.

• python / application: Examine application code for instances of HeavySelect2Mixin and related widgets. Check for unusual access token handling or storage.

# Example: Check for widget initialization during app loading
import inspect
import django
django.setup()
from .models import MyModel
from .forms import MyForm

# Check if MyForm's widgets are initialized during app loading
form = MyForm()
print(inspect.getmembers(form.fields['my_select_field'].widget))

1. 2025-05-27Disclosure

   disclosure

1. Reservado2025-05-19
2. Publicada2025-05-27
3. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-48383 is to upgrade to django-select2 version 8.4.1 or a later version, which contains the fix. If upgrading is not immediately feasible, a workaround exists for cases where widget instances are created during application loading, rather than during a request. Carefully review your code to identify any instances where widgets are initialized during app loading and implement appropriate access controls to prevent token leakage. Consider implementing stricter access control policies and regularly auditing your application for potential vulnerabilities.