Skip to content
OpenAdvisories

Package · PyPI

label-studio

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.6
    CVE-2026-22033

    Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field

    Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in the custom_hotkeys functionality of the application. An authenticated attacker (or one who can trick …

    HumanSignal label-studio label-studio PyPI
  • High 7.6
    CVE-2025-47783 Scanner template

    label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.

    Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions o…

    HumanSignal label-studio label-studio PyPI
  • High 8.6
    CVE-2025-25297

    Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

    Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery (SSRF) vulnerability in its endpoint configuration. When creating an S3 storage connection, the ap…

    HumanSignal label-studio label-studio PyPI
  • High 7.1
    CVE-2023-47115 Scanner template

    Label Studio XSS Vulnerability on Avatar Upload

    Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting (XSS) vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML …

    HumanSignal label-studio label-studio PyPI
  • High 7.5
    CVE-2023-47117 Scanner template

    Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio

    Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensi…

    HumanSignal label-studio label-studio PyPI
  • High 7.5
    GHSA-cpmr-mw4j-99r7

    Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/

    ### Summary The vulnerability resides on the Nginx config file: https://github.com/heartexlabs/label-studio/blob/53944e6bcede75ca5c102d655013f2e5238e85e6/deploy/default.conf#L119 The pattern on location /static indicates a popular misconfiguration on Nginx se…

    label-studio PyPI