GHSA-J884-Q54Q-MMX3 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-R5VV-FF45-PRP2 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-RFR2-MQ9M-X2QX vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-WJV6-JCFJ-MF9R vulnerabilities

Vulnerabilities for packages: label-studio...

Label Studio < 1.16.0 - Cross-Site Scripting Detection

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

dataops-toolkits (>=0.1.1, <=0.1.2), rm-gallery (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-22033 via label-studio (>=1.5.0, <=1.17.0)

label-studio PYPI version =1.5.0, =0.1.1, =0.1.0, =0.1.2 Source cves: CVE-2026-22033 Source advisory: OSV:PYSEC-2026-1502...

hc-nlp (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-22033 via label-studio (0.8.1)

label-studio PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio and may be impacted: - hc-nlp =0.1.0, =0.2.0 Source cves: CVE-2026-22033 Source advisory: OSV:PYSEC-2026-1502...

fast-label-studio (>=0.1.0, <=0.4.0), label-studio-paddleocr (>=0.1.0, <=0.2.0) +1 more potentially affected by CVE-2025-5173 via label-studio-ml (1.0.9)

label-studio-ml PYPI version 1.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-ml and may be impacted: - fast-label-studio =0.1.0, =0.1.0, =0.2.0 - phenocv 0.1.0 Source cves: CVE-2025-5173 Source advisory: OSV:PYSEC-2026-1505...

HumanSignal label-studio-ml-backend Deserialization of Untrusted Data vulnerability

A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/labelstudioml/examples/yolo/utils/neuralnets.py of the...

PYSEC-2026-1505 HumanSignal label-studio-ml-backend Deserialization of Untrusted Data vulnerability

A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/labelstudioml/examples/yolo/utils/neuralnets.py of the...

django-dragon (0.1.1), label-studio (>=1.3.0, <=1.4.0) potentially affected by CVE-2026-48588 via django (3.1.13)

django PYPI version 3.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-dragon 0.1.1 - label-studio =1.3.0, =1.4.0 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

django-dragon (0.1.1), label-studio (>=1.3.0, <=1.4.0) potentially affected by CVE-2026-53878 via django (3.1.13)

django PYPI version 3.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-dragon 0.1.1 - label-studio =1.3.0, =1.4.0 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

django-dragon (0.1.1), label-studio (>=1.3.0, <=1.4.0) potentially affected by CVE-2026-53877 via django (3.1.13)

django PYPI version 3.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-dragon 0.1.1 - label-studio =1.3.0, =1.4.0 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

directory-constants (>=21.0.1, <=21.0.2), djongo (1.3.7) +2 more potentially affected by CVE-2026-53878 via django (3.1.12)

django PYPI version 3.1.12 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - directory-constants =21.0.1, =1.1.0rc0, =1.2.0 - rest-framework-djongo 0.1.7 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

PYSEC-2026-1503 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

Description Label Studio's S3 storage integration feature contains a Server-Side Request Forgery SSRF vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a custom S3 endpoint URL via the s3endpoint parameter. This endpoint U...

nerblackbox (>=0.0.15, <=1.0.0) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.34)

label-studio-sdk PYPI version 0.0.34 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - nerblackbox =0.0.15, =1.0.0 Source cves: CVE-2025-25295 Source advisory: OSV:PYSEC-2026-1506...

berrydb (>=1.0.9, <=1.1.2) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.1)

label-studio-sdk PYPI version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - berrydb =1.0.9, =1.1.2 Source cves: CVE-2025-25295 Source advisory: OSV:PYSEC-2026-1506...

berrydb (>=1.1.3, <=1.5.1), label-studio (>=1.13.0, <=1.15.0) potentially affected by CVE-2025-25295 via label-studio-sdk (>=1.0.4, <=1.0.8)

label-studio-sdk PYPI version =1.0.4, =1.1.3, =1.13.0, =1.15.0 Source cves: CVE-2025-25295 Source advisory: OSV:PYSEC-2026-1506...

gantry (>=0.5.11, <=0.6.13) potentially affected by CVE-2025-25295 via label-studio-sdk (0.0.21)

label-studio-sdk PYPI version 0.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on label-studio-sdk and may be impacted: - gantry =0.5.11, =0.6.13 Source cves: CVE-2025-25295 Source advisory: OSV:PYSEC-2026-1506...

Label Studio has a Path Traversal Vulnerability via image Field

DescriptionA path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. Label Studio versions before 1.16.0 specified SDK versions prior to 1.0.10 as dependencies, and the issue was confirmed in Label Studio...