Skip to content
OpenAdvisories

Vendor

HumanSignal

17 known vulnerabilities.

Products

label-studio 16 label-studio-sdk 1 label-studio-ml-backend 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-72560

    HumanSignal Label Studio - Server-Side Request Forgery

    A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses o…

    HumanSignal label-studio
  • Medium 5.3
    CVE-2025-5173

    HumanSignal label-studio-ml-backend PT File neural_nets.py load deserialization

    A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/label_studio_ml/example…

    HumanSignal label-studio-ml-backend label-studio-ml PyPI
  • Medium 6.1
    CVE-2025-25296 Public exploit Scanner template

    Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint

    Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting…

    HumanSignal label-studio label-studio PyPI
  • Medium 4.7
    CVE-2024-26152

    Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config

    ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Choices`](https://labelstud.io/tags/choices) or [`Labels`](https://labelstud.io/tags/labels) tag, resu…

    HumanSignal label-studio label-studio PyPI
  • Medium 5.3
    CVE-2023-47116

    Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

    Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the `SSRF_PROTECTION_ENABLED` envi…

    HumanSignal label-studio label-studio PyPI
  • Medium 4.7
    CVE-2024-23633

    Label Studio XSS Vulnerability on Data Import

    Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download …

    HumanSignal label-studio label-studio PyPI