CVE-2026-121561

Label Studio before 1.23.2 label-studio-sdk before 2.1.2 contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COC...

CVE-2026-121561: HumanSignal: Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that…

Label Studio before 1.23.2 label-studio-sdk before 2.1.2 contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COC...