Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
PYSEC-2026-1502
  • PyPI/label-studio
 Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field 07 Jul
  • No fix available
  • Severity - 8.6 (High)
PYSEC-2026-1505
  • PyPI/label-studio-ml
 HumanSignal label-studio-ml-backend Deserialization of Untrusted Data vulnerability 07 Jul
  • No fix available
  • Severity - 4.8 (Medium)
PYSEC-2026-1503
  • PyPI/label-studio
 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint 07 Jul
  • Fix available
  • Severity - 8.6 (High)
PYSEC-2026-1504
  • PyPI/label-studio
 Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint 07 Jul
  • Fix available
  • Severity - 6.1 (Medium)
PYSEC-2026-1506
  • PyPI/label-studio-sdk
 Label Studio has a Path Traversal Vulnerability via image Field 07 Jul
  • Fix available
  • Severity - 8.7 (High)
GHSA-2mq9-hm29-8qch
  • PyPI/label-studio
 Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field 12 Jan
  • No fix available
  • Severity - 8.6 (High)
GHSA-55g9-6c2x-gf8q
  • PyPI/label-studio-ml
 HumanSignal label-studio-ml-backend Deserialization of Untrusted Data vulnerability 26 May 2025
  • No fix available
  • Severity - 4.8 (Medium)
GHSA-8jhr-wpcm-hh4h
  • PyPI/label-studio
 label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter. 15 May 2025
  • Fix available
  • Severity - 7.6 (High)
PYSEC-2025-124
  • PyPI/label-studio
 See record for full details 14 May 2025
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-m238-fmcw-wh58
  • PyPI/label-studio
 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint 14 Feb 2025
  • Fix available
  • Severity - 8.6 (High)
GHSA-wpq5-3366-mqw4
  • PyPI/label-studio
 Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint 14 Feb 2025
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-rgv9-w7jp-m23g
  • PyPI/label-studio-sdk
 Label Studio has a Path Traversal Vulnerability via image Field 14 Feb 2025
  • Fix available
  • Severity - 8.7 (High)
PYSEC-2024-249
  • PyPI/label-studio
  • github.com/humansignal/label-studio
 See record for full details 22 Feb 2024
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-6xv9-957j-qfhg
  • PyPI/label-studio
 Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config 22 Feb 2024
  • Fix available
  • Severity - 4.7 (Medium)
GHSA-p59w-9gqw-wj8r
  • PyPI/label-studio
 Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections 31 Jan 2024
  • Fix available
  • Severity - 5.3 (Medium)
PYSEC-2024-127
  • PyPI/label-studio
  • github.com/HumanSignal/label-studio
 See record for full details 31 Jan 2024
  • Fix available
  • Severity - 5.3 (Medium)
Load more...