label-studio vulnerabilities (PyPI)
12 vulnerabilities.
-
label-studioPyPI Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field 8.6 High -
label-studioPyPI label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter. 7.6 High -
label-studioPyPI Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint 8.6 High -
label-studioPyPI Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint 6.1 Medium -
label-studioPyPI Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config 4.7 Medium -
label-studioPyPI Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections 5.3 Medium -
label-studioPyPI Label Studio XSS Vulnerability on Data Import 4.7 Medium -
label-studioPyPI Label Studio XSS Vulnerability on Avatar Upload 7.1 High -
label-studioPyPI Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio 7.5 High -
label-studioPyPI Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens 9.8 Critical -
label-studioPyPI Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/ 7.5 High -
label-studioPyPI Heartex - Label Studio Community Edition vulnerable to SSRF in the Data Import module 6.5 Medium