Skip to main content

Transmission of Private Resources into a New Sphere ('Resource Leak')

CVE-2025-48383

High
8.2/10

Summary

Django-Select2 is a Django integration for Select2. In django-select2 package versions prior to 8.4.1, instances of `HeavySelect2Mixin` subclasses like the `ModelSelect2MultipleWidget` and `ModelSelect2Widget` can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')

The software makes resources available to untrusted parties when those resources are only intended to be accessed by the software.

References

Advisory Timeline

  • Published