CVE catalog

CVE-2025-48383

DEBIAN-CVE-2025-48383

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.33% · Oct 25, 2026

Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data. This issue has been patched in version 8.4.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandjango-select2137.10.0-2fixed
Debiandjango-select2147.10.0-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandjango-select2deb137.10.0-2Not reportedDEBIAN-CVE-2025-48383Not reported
Debiandjango-select2deb147.10.0-2Not reportedDEBIAN-CVE-2025-48383Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [python3-django-select2]Fixed

    Source package: [django-select2]

    Details (2)

    • 7.10.0-2 · all · trixie

      Fixed · Fixed: 7.10.0-2

      pypi · django-select2 · debian · 13

    • 7.10.0-2 · all · trixie

      Fixed · Fixed: 7.10.0-2

      pypi · django-select2 · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]