Label Studio has a Path Traversal Vulnerability via image Field

DescriptionA path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. Label Studio versions before 1.16.0 specified SDK versions prior to 1.0.10 as dependencies, and the issue was confirmed in Label Studio...

PYSEC-2026-1503 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

Description Label Studio's S3 storage integration feature contains a Server-Side Request Forgery SSRF vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a custom S3 endpoint URL via the s3endpoint parameter. This endpoint U...

PYSEC-2026-1506 Label Studio has a Path Traversal Vulnerability via image Field

Description A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. Label Studio versions before 1.16.0 specified SDK versions prior to 1.0.10 as dependencies, and the issue was confirmed in Label Studio...

Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint

DescriptionLabel Studio's /projects/upload-example endpoint allows injection of arbitrary HTML through a GET request with an appropriately crafted labelconfig query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attacke...

Label Studio < 1.18.0 - Reflected XSS

Label Studio 1.18.0 contains a stored XSS caused by improper sanitization in POST /projects/upload-example/ endpoint, letting attackers inject malicious scripts to hijack sessions and perform unauthorized actions, exploit requires sending crafted requests. id: CVE-2025-47783 info: name: Label...

GHSA-C38F-WX89-P2XG vulnerabilities

Vulnerabilities for packages: label-studio...

CVE-2026-44660 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-752W-5FWX-JX9F vulnerabilities

Vulnerabilities for packages: semgrep, airflow-core, request-1276, az, awx, litellm, superset, authentik-fips, datadog-agent-fips, authentik, keep-fips, py3-cassandra-medusa, metaflow-service-fips, open-webui, dbt-snowflake, airflow, kserve, datadog-agent, ggshield, pgadmin4-fips, keep,...

GHSA-3936-CMFR-PM3M vulnerabilities

Vulnerabilities for packages: kserve, nemo, open-webui, label-studio...

CVE-2026-32274 vulnerabilities

Vulnerabilities for packages: kserve, nemo, open-webui, label-studio...

CVE-2026-32597 vulnerabilities

Vulnerabilities for packages: semgrep, airflow-core, request-1276, az, awx, litellm, superset, authentik-fips, datadog-agent-fips, authentik, keep-fips, py3-cassandra-medusa, metaflow-service-fips, open-webui, dbt-snowflake, airflow, kserve, datadog-agent, ggshield, pgadmin4-fips, keep,...

CVE-2026-28350 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-HW26-MMPG-FQFG vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-XVP8-3MHV-424C vulnerabilities

Vulnerabilities for packages: label-studio...

CVE-2026-28348 vulnerabilities

Vulnerabilities for packages: label-studio...

CVE-2026-22033 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-2MQ9-HM29-8QCH vulnerabilities

Vulnerabilities for packages: label-studio...

Stored Cross-Site Scripting (XSS)

labelstudio is vulnerable to stored cross-site scripting XSS.The vulnerability is due to insufficient sanitization of user-controlled input in the customhotkeys functionality, which allows an authenticated attacker or one who tricks a user/admin to inject malicious JavaScript that executes in oth...

CVE-2026-22033

Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting XSS vulnerability exists in the customhotkeys functionality of the application. An authenticated attacker or one who can trick a user/administrator into updating their...

CVE-2026-22033

Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting XSS vulnerability exists in the customhotkeys functionality of the application. An authenticated attacker or one who can trick a user/administrator into updating their...