Security context

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

(select2.js): most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

Reflected XSS: Using unescaped f-strings inside direct HTTP responses allows attackers to inject malicious HTML payloads. The system now enforces output encoding using django.utils.html.format_html in its autocomplete views.

Auth Bypass: Resolving initial labels without preserving the original queryset filters (such as multi-tenant isolation or permission checks) can leak unauthorized database objects to unauthorized users during widget rendering.

Cross-Site Scripting (XSS): Unescaped text fields rendered inside the selection template of Select2 widgets expose users to DOM-based XSS when custom label templates do not properly escape the selected items' values.