Vulnerabilities

TI-2026-17727 CVE-2026-22033 · GHSA-2mq9-hm29-8qch

Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field

HIGH 70

Label Studio is a multi-type data labeling and annotation tool.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00279 Published 2026-01-12 No fix listed CWE-284

TI-2025-30248 CVE-2025-47783 · GHSA-8jhr-wpcm-hh4h

label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.

HIGH 68

Label Studio is a multi-type data labeling and annotation tool.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00596 Published 2025-05-14 Fixed in 1.18.0 CWE-79

TI-2025-18951 CVE-2025-25297 · GHSA-m238-fmcw-wh58

Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

HIGH 76

Label Studio is an open source data labeling tool.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00668 Published 2025-02-14 Fixed in 1.16.0 CWE-918

TI-2025-18950 CVE-2025-25296 · GHSA-wpq5-3366-mqw4

Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint

MEDIUM 60

Label Studio is an open source data labeling tool.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01898 Published 2025-02-14 Fixed in 1.16.0 CWE-79

TI-2024-17242 CVE-2024-26152 · GHSA-6xv9-957j-qfhg

Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config

MEDIUM 60

### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Choices`](https://labelstud.io/tags/choices) or [`Labels`](http…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02199 Published 2024-02-22 Fixed in 1.11.0 CWE-79

TI-2023-25456 CVE-2023-47116 · GHSA-p59w-9gqw-wj8r

Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

MEDIUM 57

Label Studio is a popular open source data labeling tool.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00737 Published 2024-01-31 Fixed in 1.11.0 CWE-918

TI-2024-15652 CVE-2024-23633 · GHSA-fq23-g58m-799r

Label Studio XSS Vulnerability on Data Import

MEDIUM 60

Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00592 Published 2024-01-23 Fixed in 1.10.1 CWE-79

TI-2023-25455 CVE-2023-47115 · GHSA-q68h-xwq5-mm7x

Label Studio XSS Vulnerability on Avatar Upload

MEDIUM 64

Label Studio is an a popular open source data labeling tool.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.01448 Published 2024-01-23 Fixed in 1.9.2 CWE-79

TI-2023-25457 CVE-2023-47117 · GHSA-6hjj-gq77-j4qw

Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio

HIGH 72

Label Studio is an open source data labeling tool.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04055 Published 2023-11-13 Fixed in 1.9.2post0, 1.9.2.post0 CWE-200

TI-2023-23482 CVE-2023-43791 · GHSA-f475-x83m-rx5m

Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

HIGH 82

Label Studio is a multi-type data labeling and annotation tool with standardized output format.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01241 Published 2023-11-09 Fixed in 1.8.2 CWE-200

Vulnerabilities

Filters