From Salvatore Bonaccorso@21:1/5 to All on Thu May 29 07:10:01 2025
Source: django-select2
Version: 7.10.0-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Hi,
The following vulnerability was published for django-select2.
CVE-2025-48383[0]:
| Django-Select2 is a Django integration for Select2. Prior to version
| 8.4.1, instances of HeavySelect2Mixin subclasses like the
| ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret
| access tokens across requests. This can allow users to access
| restricted query sets and restricted data. This issue has been
| patched in version 8.4.1.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.