Read the docs
TI-2023-25457 Aliases CVE-2023-47117GHSA-6hjj-gq77-j4qw

Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio

Priority HIGH 72CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by character. In addition, Label Studio had a hard coded secret key that an attacker can use to forge a session token of any user by exploiting this ORM Leak vulnerability to leak account password hashes. This vulnerability has been addressed in commit `f931d9d129` which is included in the 1.9.2post0 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.04055 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed label-studio (HumanSignal): 1.9.2post0label-studio (PyPI): 1.9.2.post0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HumanSignallabel-studiobefore 1.9.2post01.9.2post0Patch availableCNA
—label-studio (PyPI)before 1.9.2.post01.9.2.post0Patch availableGHSA-6hjj-gq77-j4qw
  • label-studio VendorHumanSignal Affected before 1.9.2post0 Fixed in 1.9.2post0 Patch available CNA
  • label-studio (PyPI) Vendor— Affected before 1.9.2.post0 Fixed in 1.9.2.post0 Patch available GHSA-6hjj-gq77-j4qw

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:*before 1.9.2VulnerableHumanSignal
cpe:2.3:a:humansignal:label_studio:1.9.2:-:*:*:*:*:*:*1.9.2VulnerableHumanSignal
  • cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:* Versions before 1.9.2 Vulnerable ·HumanSignal
  • cpe:2.3:a:humansignal:label_studio:1.9.2:-:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·HumanSignal

Remediation

  • Fix · CNA label-studio (HumanSignal) Fixed in 1.9.2post0
  • Fix · GHSA-6hjj-gq77-j4qw label-studio (PyPI) Fixed in 1.9.2.post0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-47117
  2. 2026-10-03 Alias added: GHSA-6hjj-gq77-j4qw

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2023-23482 Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens CVSS 3.1CRITICAL 9.8
  • TI-2025-18951 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint CVSS 3.1HIGH 8.6
  • TI-2026-17727 Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field CVSS 4.0HIGH 8.6
  • TI-2025-30248 label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter. CVSS 4.0HIGH 7.6
  • TI-2023-25455 Label Studio XSS Vulnerability on Avatar Upload CVSS 3.1HIGH 7.1
  • TI-2025-18950 Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint CVSS 3.1MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences