Humansignal Label Studio vulnerabilities

• humansignal label studio, label-studio +1 more Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field CVE-2026-22033 8.6 HighJanuary 12, 2026
• humansignal label-studio-ml-backend, label studio ml backend +1 more HumanSignal label-studio-ml-backend PT File neural_nets.py load deserialization CVE-2025-5173 4.8 MediumMay 26, 2025
• humansignal label-studio, label studio +1 more label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter. CVE-2025-47783 Fix available 7.6 HighMay 14, 2025
• humansignal label studio, label-studio +1 more Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint CVE-2025-25297 Fix available 8.6 HighFebruary 14, 2025
• humansignal label studio, label-studio +1 more Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint CVE-2025-25296 Public exploitFix available 6.1 MediumFebruary 14, 2025
• humansignal label-studio, label studio +1 more Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config CVE-2024-26152 Fix available 4.7 MediumFebruary 22, 2024
• humansignal label studio, label-studio +1 more Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections CVE-2023-47116 Fix available 5.3 MediumJanuary 31, 2024
• humansignal label studio, label-studio +1 more Label Studio XSS Vulnerability on Data Import CVE-2024-23633 Fix available 4.7 MediumJanuary 23, 2024
• humansignal label studio, label-studio +1 more Label Studio XSS Vulnerability on Avatar Upload CVE-2023-47115 Fix available 7.1 HighJanuary 23, 2024
• humansignal label studio, label-studio +1 more Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio CVE-2023-47117 Fix available 7.5 HighNovember 13, 2023
• humansignal label studio, label-studio +1 more Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens CVE-2023-43791 Fix available 9.8 CriticalNovember 9, 2023