What’s Vulnerable › Products

HumanSignal label-studio vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your HumanSignal label-studio version is affected

Latest HumanSignal label-studio vulnerabilities

• CVE-2026-85211 — Label Studio through 1.23.0 Cross-Organization Storage URI Resolution (CVSS 7.7)
• CVE-2026-85179 — Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL (CVSS 8.5)
• CVE-2026-76073 — Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset (CVSS 8.8)
• CVE-2026-72560 — HumanSignal Label Studio - Server-Side Request Forgery (CVSS 6.5)
• CVE-2026-22033 — Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field (CVSS 5.4)
• CVE-2025-47783 — label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter. (CVSS 6.1)
• CVE-2025-25297 — Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint (CVSS 7.7)
• CVE-2025-25296 — Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint (CVSS 6.1)
• CVE-2025-25295 — Label Studio has a Path Traversal Vulnerability via image Field (CVSS 8.7)
• CVE-2024-26152 — Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config (CVSS 6.1)
• CVE-2023-47116 — Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections (CVSS 5.3)
• CVE-2024-23633 — Label Studio XSS Vulnerability on Data Import (CVSS 6.1)
• CVE-2023-47115 — Label Studio XSS Vulnerability on Avatar Upload (CVSS 5.4)
• CVE-2023-47117 — Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio (CVSS 7.5)
• CVE-2023-43791 — Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens (CVSS 8.8)