hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-43791 via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: CVE-2023-43791 Source advisory: OSV:PYSEC-2023-274...

hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-43791 via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: CVE-2023-43791 Source advisory: OSV:GHSA-F475-X83M-RX5M...

CVE-2023-43791 Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges...

CVE-2023-43791

Label Studio (before 1.8.2) is affected by an ORM Leak chain that can impersonate any account, enabling privilege escalation to a Django Super Administrator. A patch was introduced in 1.8.2. Public references describe a hard-coded SECRET_KEY vulnerability and a follow-on exploit path that leverag...