Advisoriesby Ibis
Label Studio security advisories
12 advisories · 1 critical or high in 12 months · latest Jan 12
12 advisories
Label Studio: cross-site scriptingCVE-2026-22033no fix yetlabel-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameterCVE-2025-47783fixed in 1.18.0Label Studio allows Server-Side Request Forgery in the S3 Storage EndpointCVE-2025-25297fixed in 1.16.0Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpointCVE-2025-25296fixed in 1.16.0Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling configCVE-2024-26152fixed in 1.11.0Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` ProtectionsCVE-2023-47116fixed in 1.11.0Cross-site Scripting Vulnerability on Data ImportCVE-2024-23633fixed in 1.10.1Cross-site Scripting Vulnerability on Avatar UploadCVE-2023-47115fixed in 1.9.2Label Studio Object Relational Mapper Leak Vulnerability in Filtering TaskCVE-2023-47117fixed in 1.9.2.post0Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session TokensCVE-2023-43791fixed in 1.8.2Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/GHSA-cpmr-mw4j-99r7fixed in 1.7.2Heartex - Label Studio Community Edition vulnerable to SSRF in the Data Import moduleCVE-2022-36551fixed in 1.6.0