What’s Vulnerable › Vulnerabilities

CVE-2023-47116: Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-31 · updated 2026-06-17
• Weakness: CWE-918

Description

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the `SSRF_PROTECTION_ENABLED` environment variable can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to verify that the IP address is not in an excluded subnet range. This protection can be bypassed by either using HTTP redirection or performing a DNS rebinding attack.

Affected products

• HumanSignal label-studio: before 1.11.0 — fixed in 1.11.0

How to fix

Upgrade to a fixed version: HumanSignal label-studio 1.11.0. Check the vendor advisory for mitigations.

References

• https://github.com/HumanSignal/label-studio/commit/55dd6af4716b92f2bb213fe461d1ffbc380c6a64
• https://github.com/HumanSignal/label-studio/releases/tag/1.11.0
• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-p59w-9gqw-wj8r
• https://github.com/HumanSignal/label-studio/commit/55dd6af4716b92f2bb213fe461d1ffbc380c6a64
• https://github.com/HumanSignal/label-studio/releases/tag/1.11.0
• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-p59w-9gqw-wj8r

Get alerted when CVE-2023-47116 or the next vulnerability affects your stack