Skip to content
OpenAdvisories

Package · PyPI

label-studio

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2025-25296 Public exploit Scanner template

    Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint

    Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting…

    HumanSignal label-studio label-studio PyPI
  • Medium 6.5
    CVE-2022-36551 Public exploit

    Heartex - Label Studio Community Edition vulnerable to SSRF in the Data Import module

    A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in…

    label-studio PyPI