Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2022-36551 EUVD-2022-0136GHSA-pc6f-259w-w3j6PYSEC-2022-300

Heartex - Label Studio Community Edition vulnerable to SSRF in the Data Import module

Published Oct 3, 2022 · Updated Jul 9, 2026 · Assigned by mitre

Package: label-studio Ecosystem: PyPI

Description

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI label-studio < 1.6.0 1.6.0 GHSA-pc6f-259w-w3j6
PyPI label-studio < 1.5.0.post0 1.5.0.post0 PYSEC-2022-300

References