Priority MEDIUM 61
Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats.
CVSS 4.0MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00432 · Published 2026-11-03 · Fixed in 1.23.2, 2.1.2 CWE-918
Priority HIGH 69
Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints.
CVSS 4.0HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00415 · Published 2026-09-03 · No fix listed CWE-639
Priority HIGH 70
Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints.
CVSS 4.0HIGH 8.4· Network · Low privileges · No interaction · EPSS 0.00401 · Published 2026-09-03 · No fix listed CWE-918
Priority MEDIUM 40
Label Studio does not scope the annotation detail endpoint to the requesting user's organization.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00523 · Published 2026-08-24 · No fix listed CWE-639
Priority LOW 29
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0034 · Published 2026-08-11 · No fix listed CWE-918
Priority HIGH 70
Label Studio is a multi-type data labeling and annotation tool.
CVSS 4.0HIGH 8.6· Network · Low privileges · No interaction · EPSS 0.00279 · Published 2026-01-12 · No fix listed CWE-284
Priority LOW 22
A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic.
CVSS 4.0MEDIUM 4.8· Local · Low privileges · No interaction · EPSS 0.00239 · Published 2025-05-26 · No fix listed CWE-20
Priority HIGH 68
Label Studio is a multi-type data labeling and annotation tool.
CVSS 4.0HIGH 7.6· Network · No auth · User interaction · EPSS 0.00596 · Published 2025-05-14 · Fixed in 1.18.0 CWE-79
Priority HIGH 76
Label Studio is an open source data labeling tool.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00668 · Published 2025-02-14 · Fixed in 1.16.0 CWE-918
Priority MEDIUM 60
Label Studio is an open source data labeling tool.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01898 · Published 2025-02-14 · Fixed in 1.16.0 CWE-79
Priority HIGH 77
Label Studio is an open source data labeling tool.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00761 · Published 2025-02-14 · Fixed in 1.0.10 CWE-22
Priority MEDIUM 60
### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Choices`](https://labelstud.io/tags/choices) or [`Labels`](http…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02199 · Published 2024-02-22 · Fixed in 1.11.0 CWE-79
Priority MEDIUM 57
Label Studio is a popular open source data labeling tool.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00737 · Published 2024-01-31 · Fixed in 1.11.0 CWE-918
Priority MEDIUM 60
Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00592 · Published 2024-01-23 · Fixed in 1.10.1 CWE-79
Priority MEDIUM 64
Label Studio is an a popular open source data labeling tool.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.01448 · Published 2024-01-23 · Fixed in 1.9.2 CWE-79
Priority HIGH 72
Label Studio is an open source data labeling tool.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04055 · Published 2023-11-13 · Fixed in 1.9.2post0, 1.9.2.post0 CWE-200
Priority HIGH 82
Label Studio is a multi-type data labeling and annotation tool with standardized output format.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01241 · Published 2023-11-09 · Fixed in 1.8.2 CWE-200
THREATIST.IORead the docs