Humansignal Label-studio vulnerabilities

• humansignal label-studio, label-studio-sdk +1 more Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads CVE-2026-121561 6.3 MediumNovember 3, 2026
• humansignal label-studio Label Studio through 1.23.0 Cross-Organization Storage URI Resolution CVE-2026-85211 8.3 HighSeptember 3, 2026
• humansignal label-studio Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL CVE-2026-85179 8.4 HighSeptember 3, 2026
• humansignal label-studio Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset CVE-2026-76073 8.7 HighAugust 24, 2026
• humansignal label studio, label-studio +1 more Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field CVE-2026-22033 8.6 HighJanuary 12, 2026
• humansignal label-studio-ml-backend, label studio ml backend +1 more HumanSignal label-studio-ml-backend PT File neural_nets.py load deserialization CVE-2025-5173 4.8 MediumMay 26, 2025
• humansignal label-studio, label studio +1 more label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter. CVE-2025-47783 Fix available 7.6 HighMay 14, 2025
• humansignal label studio, label-studio +1 more Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint CVE-2025-25297 Fix available 8.6 HighFebruary 14, 2025
• humansignal label studio, label-studio +1 more Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint CVE-2025-25296 Public exploitFix available 6.1 MediumFebruary 14, 2025
• humansignal label-studio Label Studio has a Path Traversal Vulnerability via image Field CVE-2025-25295 Fix available 8.7 HighFebruary 14, 2025
• humansignal label-studio, label studio +1 more Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config CVE-2024-26152 Fix available 4.7 MediumFebruary 22, 2024
• humansignal label studio, label-studio +1 more Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections CVE-2023-47116 Fix available 5.3 MediumJanuary 31, 2024
• humansignal label studio, label-studio +1 more Label Studio XSS Vulnerability on Data Import CVE-2024-23633 Fix available 4.7 MediumJanuary 23, 2024
• humansignal label studio, label-studio +1 more Label Studio XSS Vulnerability on Avatar Upload CVE-2023-47115 Fix available 7.1 HighJanuary 23, 2024
• humansignal label studio, label-studio +1 more Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio CVE-2023-47117 Fix available 7.5 HighNovember 13, 2023
• humansignal label studio, label-studio +1 more Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens CVE-2023-43791 Fix available 9.8 CriticalNovember 9, 2023