VYPR
Get started
← All advisories
High severity8.2NVD Advisory· Published May 27, 2025· Updated Apr 15, 2026

CVE-2025-48383

CVE-2025-48383

Description

Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data. This issue has been patched in version 8.4.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
django-select2PyPI
< 8.4.18.4.1

Patches

1
e5f41e6edba0

Merge commit from fork

https://github.com/codingjoe/django-select2Johannes MaronMay 26, 2025via ghsa
commit
2 files changed · +13 −2
  • django_select2/forms.py+2 −2 modified
    @@ -255,8 +255,6 @@ def __init__(self, attrs=None, choices=(), **kwargs):
         """
         super().__init__(attrs, choices)
 
-        self.uuid = str(uuid.uuid4())
-        self.field_id = signing.dumps(self.uuid)
         self.data_view = kwargs.pop("data_view", self.data_view)
         self.data_url = kwargs.pop("data_url", self.data_url)
 
@@ -275,6 +273,8 @@ def get_url(self):
 
     def build_attrs(self, base_attrs, extra_attrs=None):
         """Set select2's AJAX attributes."""
+        self.uuid = str(uuid.uuid4())
+        self.field_id = signing.dumps(self.uuid)
         default_attrs = {
             "data-ajax--url": self.get_url(),
             "data-ajax--cache": "true",
  • tests/test_forms.py+11 −0 modified
    @@ -359,6 +359,17 @@ def test_theme_setting(self, settings):
         widget = self.widget_cls(data_view="heavy_data_1")
         assert 'data-theme="classic"' in widget.render("name", None)
 
+    def test_cache_key_leak(self):
+        bob = self.widget_cls(data_url="/test/")
+        alice = self.widget_cls(data_url="/test/")
+        bob.render("name", "value")
+        bob_key_request_1 = bob._get_cache_key()
+        alice.render("name", "value")
+        assert bob._get_cache_key() != alice._get_cache_key()
+        bob.render("name", "value")
+        bob_key_request_2 = bob._get_cache_key()
+        assert bob_key_request_1 != bob_key_request_2
+
 
 class TestModelSelect2Mixin(TestHeavySelect2Mixin):
     form = forms.AlbumModelSelect2WidgetForm(initial={"primary_genre": 1})

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.