Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

label-studio — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in label-studio, with AI-generated Chinese analysis, references, and POCs.

Vendor: HumanSignal

CVE IDTitleCVSSSeverityPublished
CVE-2026-22033 Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field CWE-79 5.4AIMediumAI2026-01-12
CVE-2025-47783 label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter. CWE-79 8.2AIHighAI2025-05-14
CVE-2025-25297 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint CWE-918 8.6 High2025-02-14
CVE-2025-25296 Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint CWE-79 6.1 Medium2025-02-14
CVE-2025-25295 Label Studio has a Path Traversal Vulnerability via image Field CWE-22 7.5 -2025-02-14
CVE-2024-26152 Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config CWE-79 4.7 Medium2024-02-22
CVE-2023-47116 Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections CWE-918 5.3 Medium2024-01-31
CVE-2024-23633 Label Studio XSS Vulnerability on Data Import CWE-79 4.7 Medium2024-01-23
CVE-2023-47115 Label Studio XSS Vulnerability on Avatar Upload CWE-79 7.1 High2024-01-23
CVE-2023-47117 Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio CWE-200 7.5 High2023-11-13
CVE-2023-43791 Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens CWE-200 9.8 Critical2023-11-09

All 11 known CVE vulnerabilities affecting label-studio with full Chinese analysis, references, and POCs where available.