dataops-toolkits (>=0.1.1, <=0.1.2), hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2025-25296 via label-studio (>=0.8.1, <=1.5.0)

label-studio PYPI version =0.8.1, =0.1.1, =0.1.0, =0.2.0 Source cves: CVE-2025-25296 Source advisory: MEND:CVE-2025-25296...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2025-25295 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2025-25295 Source advisory: SNYK:PYTHON-LABELSTUDIO-8730850...

berrydb (>=1.1.3, <=1.5.1), label-studio (>=1.13.0, <=1.15.0) potentially affected by CVE-2025-25295 via label-studio-sdk (>=1.0.4, <=1.0.8)

label-studio-sdk PYPI version =1.0.4, =1.1.3, =1.13.0, =1.15.0 Source cves: CVE-2025-25295 Source advisory: SNYK:PYTHON-LABELSTUDIOSDK-8730849...

Directory Traversal

Overview label-studio is a Label Studio annotation tool Affected versions of this package are vulnerable to Directory Traversal via the download function due to improper input validation when processing image references during task exports. . An attacker can access files outside the intended...

CVE-2025-25295

Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a...

CVE-2025-25295 Label Studio has a Path Traversal Vulnerability via image Field

Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a...

CVE-2025-25295 Label Studio has a Path Traversal Vulnerability via image Field

Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a...

CVE-2025-25295

Summary: CVE-2025-25295 affects Label Studio and its SDK with a path traversal vulnerability in VOC/COCO/YOLO exports. The root cause is improper file path validation in the label-studio-sdk download function, which processes image references during task exports and can read arbitrary server file...

berrydb (>=1.0.9, <=1.5.1), datapipe-label-studio-lite (>=0.2.0, <=0.3.3) +3 more potentially affected by CVE-2025-25295 via label-studio-sdk (>=0.0.1, <=1.0.8)

label-studio-sdk PYPI version =0.0.1, =1.0.9, =0.2.0, =0.5.11, =1.13.0, =0.0.15, =1.0.0 Source cves: CVE-2025-25295 Source advisory: MEND:CVE-2025-25295...

CVE-2025-25295 Label Studio has a Path Traversal Vulnerability via image Field

Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a...

CVE-2025-25295

Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a...

Server-side Request Forgery (SSRF)

Overview label-studio is a Label Studio annotation tool Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the s3endpoint parameter due to improper input validation. An attacker can make the application send HTTP requests to arbitrary internal services by...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2025-25297 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2025-25297 Source advisory: GHSA-M238-FMCW-WH58...

hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2025-25297 via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: CVE-2025-25297 Source advisory: OSV:GHSA-M238-FMCW-WH58...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2025-25297 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2025-25297 Source advisory: OSV:GHSA-M238-FMCW-WH58...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2025-25297 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2025-25297 Source advisory: SNYK:PYTHON-LABELSTUDIO-8730847...

GHSA-M238-FMCW-WH58 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

Description Label Studio's S3 storage integration feature contains a Server-Side Request Forgery SSRF vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a custom S3 endpoint URL via the s3endpoint parameter. This endpoint U...

GHSA-WPQ5-3366-MQW4 Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint

Description Label Studio's /projects/upload-example endpoint allows injection of arbitrary HTML through a GET request with an appropriately crafted labelconfig query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attack...

hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2025-25296 via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: CVE-2025-25296 Source advisory: OSV:GHSA-WPQ5-3366-MQW4...

dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2025-25296 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2025-25296 Source advisory: OSV:GHSA-WPQ5-3366-MQW4...