PT-2024-13408

Name of the Vulnerable Software and Affected Versions Label Studio versions prior to 1.11.0 Description The issue affects Label Studio's SSRF protections, which can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to...

GHSA-FQ23-G58M-799R Cross-site Scripting Vulnerability on Data Import

Introduction This write-up describes a vulnerability found in Label Studio, a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.10.1 and was tested on version 1.9.2.post0. Overview Label Studio had a remote import feature allowed users to...

hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2024-23633 via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: CVE-2024-23633 Source advisory: OSV:GHSA-FQ23-G58M-799R...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2024-23633 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2024-23633 Source advisory: GHSA-FQ23-G58M-799R...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2024-23633 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2024-23633 Source advisory: OSV:GHSA-FQ23-G58M-799R...

GHSA-Q68H-XWQ5-MM7X Cross-site Scripting Vulnerability on Avatar Upload

Introduction This write-up describes a vulnerability found in Label Studio, a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.9.2 and was tested on version 1.8.2. Overview Label Studio has a cross-site scripting XSS vulnerability that coul...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2023-47115 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2023-47115 Source advisory: OSV:GHSA-Q68H-XWQ5-MM7X...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2023-47115 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2023-47115 Source advisory: GHSA-Q68H-XWQ5-MM7X...

hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-47115 via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: CVE-2023-47115 Source advisory: OSV:GHSA-Q68H-XWQ5-MM7X...

Cross Site Scripting (XSS)

labelstudio is vulnerable to Cross Site Scripting XSS. The vulnerability is due to not sanitizing/validating the HTML/JavaScript file that was downloaded from the import data feature from a remote web resource. An attacker can exploit this to download a HTML file that executes malicious JavaScrip...

CVE-2024-23633

Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious...

PYSEC-2024-128

Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious...

hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2024-23633 via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: CVE-2024-23633 Source advisory: OSV:PYSEC-2024-128...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2024-23633 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2024-23633 Source advisory: OSV:PYSEC-2024-128...

CVE-2024-23633

CVE-2024-23633 affects Label Studio (open‑source data labeling tool) prior to version 1.10.1. The issue arises in the remote import feature: when a URL is fetched, the server uses the URL’s filename and returns a file via an API, with the response content type determined by the file’s extension (...

CVE-2024-23633 Label Studio XSS Vulnerability on Data Import

Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious...

CVE-2024-23633 Label Studio XSS Vulnerability on Data Import

Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious...

dataops-toolkits (>=0.1.1, <=0.1.2), hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2024-23633 via label-studio (>=0.8.1, <=1.5.0)

label-studio PYPI version =0.8.1, =0.1.1, =0.1.0, =0.2.0 Source cves: CVE-2024-23633 Source advisory: MEND:CVE-2024-23633...

CVE-2024-23633

Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2023-47115 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2023-47115 Source advisory: OSV:PYSEC-2024-126...