dataops-toolkits (>=0.1.1, <=0.1.2) potentially affected by CVE-2025-25296 via label-studio (1.5.0)

label-studio PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - dataops-toolkits =0.1.1, =0.1.2 Source cves: CVE-2025-25296 Source advisory: GHSA-WPQ5-3366-MQW4...

datapipe-label-studio-lite (>=0.2.0, <=0.3.3) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.16)

label-studio-sdk PYPI version 0.0.16 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - datapipe-label-studio-lite =0.2.0, =0.3.3 Source cves: CVE-2025-25295 Source advisory: OSV:GHSA-RGV9-W7JP-M23G...

Label Studio has a Path Traversal Vulnerability via image Field

Description A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. Label Studio versions before 1.16.0 specified SDK versions prior to 1.0.10 as dependencies, and the issue was confirmed in Label Studio...

nerblackbox (>=0.0.15, <=1.0.0) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.34)

label-studio-sdk PYPI version 0.0.34 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - nerblackbox =0.0.15, =1.0.0 Source cves: CVE-2025-25295 Source advisory: OSV:GHSA-RGV9-W7JP-M23G...

berrydb (>=1.1.3, <=1.5.1), label-studio (>=1.13.0, <=1.15.0) potentially affected by CVE-2025-25295 via label-studio-sdk (>=1.0.4, <=1.0.8)

label-studio-sdk PYPI version =1.0.4, =1.1.3, =1.13.0, =1.15.0 Source cves: CVE-2025-25295 Source advisory: GHSA-RGV9-W7JP-M23G...

gantry (>=0.5.11, <=0.6.13) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.21)

label-studio-sdk PYPI version 0.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - gantry =0.5.11, =0.6.13 Source cves: CVE-2025-25295 Source advisory: OSV:GHSA-RGV9-W7JP-M23G...

GHSA-RGV9-W7JP-M23G Label Studio has a Path Traversal Vulnerability via image Field

Description A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. Label Studio versions before 1.16.0 specified SDK versions prior to 1.0.10 as dependencies, and the issue was confirmed in Label Studio...

berrydb (>=1.1.3, <=1.5.1), label-studio (>=1.13.0, <=1.15.0) potentially affected by CVE-2025-25295 via label-studio-sdk (>=1.0.4, <=1.0.8)

label-studio-sdk PYPI version =1.0.4, =1.1.3, =1.13.0, =1.15.0 Source cves: CVE-2025-25295 Source advisory: OSV:GHSA-RGV9-W7JP-M23G...

berrydb (>=1.0.9, <=1.1.2) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.1)

label-studio-sdk PYPI version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - berrydb =1.0.9, =1.1.2 Source cves: CVE-2025-25295 Source advisory: OSV:GHSA-RGV9-W7JP-M23G...

CVE-2025-25295: Improper Limitation of a Pathname to a Restricted Directory

Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a...

PT-2025-7074

Name of the Vulnerable Software and Affected Versions: Label Studio versions prior to 1.16.0 Label Studio SDK versions prior to 1.0.10 Description: A path traversal vulnerability in Label Studio SDK allows unauthorized file access outside the intended directory structure. The flaw exists in the...

PT-2025-7076

Name of the Vulnerable Software and Affected Versions: Label Studio versions prior to 1.16.0 Description: Label Studio's S3 storage integration feature contains a Server-Side Request Forgery SSRF vulnerability in its endpoint configuration. When creating an S3 storage connection, the application...

CVE-2025-25296: Improper Neutralization of Input During Web Page Generation

Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's /projects/upload-example endpoint allows injection of arbitrary HTML through a GET request with an appropriately crafted labelconfig query parameter. By crafting a specially formatted XML label config with...

CVE-2025-25297: Server-Side Request Forgery (SSRF)

Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery SSRF vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a cust...

Label Studio security vulnerabilities

Label Studio is an open source data labeling tool from Heartex Open Source. It allows you to label data types such as audio, text, images, video, and time series using a straightforward UI and export to a variety of model formats. A security vulnerability exists in Label Studio versions prior to...

Label Studio cross-site scripting vulnerabilities

Label Studio is an open source data labeling tool from Heartex Open Source. It allows you to label data types such as audio, text, images, video, and time series using a straightforward UI, and export to a variety of model formats. A cross-site scripting vulnerability exists in versions prior to...

Label Studio code issue vulnerabilities

Label Studio is an open source data labeling tool from Heartex Open Source. It allows you to label data types such as audio, text, images, video, and time series using a straightforward UI and export to a variety of model formats. A code issue vulnerability exists in Label Studio versions prior t...

django-dragon (0.1.1), label-studio (>=1.3.0, <=1.4.0) potentially affected by CVE-2024-45231 via django (3.1.13)

django PYPI version 3.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-dragon 0.1.1 - label-studio =1.3.0, =1.4.0 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

bugbug (>=0.0.148, <=0.0.185), label-studio (0.4.1) potentially affected by CVE-2024-27454 via orjson (2.1.3)

orjson PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.148, =0.0.185 - label-studio 0.4.1 Source cves: CVE-2024-27454 Source advisory: OSV:GHSA-PWR2-4V36-6QPR...

bugbug (>=0.0.148, <=0.0.185), label-studio (0.4.1) potentially affected by CVE-2024-27454 via orjson (2.1.3)

orjson PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.148, =0.0.185 - label-studio 0.4.1 Source cves: CVE-2024-27454 Source advisory: OSV:PYSEC-2024-40...