HumanSignal Label Studio

• CVE-2026-121561 High 7.7 Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads 0.4%
• CVE-2026-85211 High 7.7 Label Studio through 1.23.0 Cross-Organization Storage URI Resolution 0.4%
• CVE-2026-85179 High 8.5 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL 0.4%
• CVE-2026-76073 High 8.8 Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset 0.5%
• CVE-2026-72560 Medium 6.5 HumanSignal Label Studio - Server-Side Request Forgery 0.3%
• CVE-2026-22033 High 8.6 Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field 0.3%
• CVE-2025-47783 High 7.6 label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter. 0.6%
• CVE-2025-25297 High 8.6 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint 0.7%
• CVE-2025-25296 Medium 6.1 Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint 1.9%
• CVE-2025-25295 High 8.7 Label Studio has a Path Traversal Vulnerability via image Field 0.8%
• CVE-2024-26152 Medium 4.7 Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config 2.2%
• CVE-2023-47116 Medium 5.3 Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections 0.7%
• CVE-2024-23633 Medium 4.7 Label Studio XSS Vulnerability on Data Import 0.6%
• CVE-2023-47115 High 7.1 Label Studio XSS Vulnerability on Avatar Upload 1.4%
• CVE-2023-47117 High 7.5 Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio 4.1%
• CVE-2023-43791 Critical 9.8 Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens 1.2%