humansignal/label-studio Security Advisories | GitStock

high2026-01-12

Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field

GHSA-2mq9-hm29-8qch · CVE-2026-22033

high2025-05-15

label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.

GHSA-8jhr-wpcm-hh4h · CVE-2025-47783

high2025-02-14

Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

GHSA-m238-fmcw-wh58 · CVE-2025-25297

medium2025-02-14

Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint

GHSA-wpq5-3366-mqw4 · CVE-2025-25296

medium2024-02-22

Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config

GHSA-6xv9-957j-qfhg · CVE-2024-26152

medium2024-01-31

Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

GHSA-p59w-9gqw-wj8r · CVE-2023-47116

medium2024-01-24

Cross-site Scripting Vulnerability on Data Import

GHSA-fq23-g58m-799r · CVE-2024-23633

high2024-01-24

Cross-site Scripting Vulnerability on Avatar Upload

GHSA-q68h-xwq5-mm7x · CVE-2023-47115

high2023-11-14

Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task

GHSA-6hjj-gq77-j4qw · CVE-2023-47117

critical2023-11-09

Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

GHSA-f475-x83m-rx5m · CVE-2023-43791