Security
فارسی
All products

label-studio

PyPI · Package
12 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys fieldCVE-2026-22033 · GHSA-2MQ9-HM29-8QCHVersion ranges need review. label-studio PyPI High No fix reported
Cross-site Scripting Vulnerability on Avatar UploadCVE-2023-47115 · GHSA-Q68H-XWQ5-MM7XVersion ranges need review. label-studio PyPI High Fix reported
Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` ProtectionsCVE-2023-47116 · GHSA-P59W-9GQW-WJ8RVersion ranges need review. label-studio PyPI Medium Fix reported
Label Studio Object Relational Mapper Leak Vulnerability in Filtering TaskCVE-2023-47117 · GHSA-6HJJ-GQ77-J4QWVersion ranges need review. label-studio PyPI High Fix reported
Cross-site Scripting Vulnerability on Data ImportCVE-2024-23633 · GHSA-FQ23-G58M-799RVersion ranges need review. label-studio PyPI Medium Fix reported
Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/GHSA-CPMR-MW4J-99R7 label-studio PyPI High Fix reported
Label Studio allows Server-Side Request Forgery in the S3 Storage EndpointCVE-2025-25297 · GHSA-M238-FMCW-WH58Version ranges need review. label-studio PyPI High Fix reported
Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpointCVE-2025-25296 · GHSA-WPQ5-3366-MQW4Version ranges need review. label-studio PyPI Medium Fix reported
Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config CVE-2024-26152 · GHSA-6XV9-957J-QFHGVersion ranges need review. label-studio PyPI Medium Fix reported
Heartex - Label Studio Community Edition vulnerable to SSRF in the Data Import moduleCVE-2022-36551 · GHSA-PC6F-259W-W3J6Version ranges need review. label-studio PyPI High Fix reported
label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.CVE-2025-47783 · GHSA-8JHR-WPCM-HH4HVersion ranges need review. label-studio PyPI High Fix reported
Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session TokensCVE-2023-43791 · GHSA-F475-X83M-RX5MVersion ranges need review. label-studio PyPI Critical Fix reported