CVE-2025-48383 Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking
Attackers can leak secret access tokens from widget instances, allowing unauthorized access to restricted data and query sets in Django applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48383?
CVE-2025-48383 is a high-severity vulnerability in codingjoe django-select2, published on 27 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data. This issue has been patched in version 8.4.1.
Which versions are affected by CVE-2025-48383?
3 open source packages ship an affected version, including django-select2.
| Package | Affected | Fixed in |
|---|---|---|
django-select2 PyPI | All versions | 8.4.1 |
django-select2 PyPI | All versions | 8.4.1 |
django-select2 PyPI | All versions | 8.4.1 |
How do I fix CVE-2025-48383?
Upgrade django-select2 to 8.4.1 or later.
Is CVE-2025-48383 being exploited?
There is no known exploitation of CVE-2025-48383 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-48383, GHSA-wjrh-hj83-3wh7, PYSEC-2026-1300, UBUNTU-CVE-2025-48383.