Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

label-studio

11 known vulnerabilities (1 critical, 5 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
1.23.2 (Sep 29, 2026): no advisory with comparable ranges affects it; 1 advisory (CVE-2024-26152) can't be checked against versions
Newest unaffected release
1.23.2 (Sep 29, 2026), the latest release, not counting 1 advisory without comparable ranges
Advisories
11 · 1 critical, 5 high, 4 medium
Weekly downloads
9,224
Dependents
2
Releases
100 since 0.4.1 (Jan 10, 2020)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 11

  • Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field

    Affected: through 1.22.0.

    Fixed in 1.23.0 (released Mar 13, 2026, 60 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.23.2, is not affected.

  • label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.

    Affected: fixed in 1.18.0.

    Fixed in 1.18.0 (released May 14, 2025, the day of disclosure).

    The latest release, 1.23.2, is not affected.

  • Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

    Affected: fixed in 1.16.0.

    Fixed in 1.16.0 (released Feb 13, 2025, 1 day before disclosure).

    The latest release, 1.23.2, is not affected.

  • CVE-2025-25296Medium 6.1

    Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint

    Affected: fixed in 1.16.0.

    Fixed in 1.16.0 (released Feb 13, 2025, 1 day before disclosure).

    The latest release, 1.23.2, is not affected.

  • CVE-2024-26152Medium 4.7

    Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config

    Affected: fixed in 1.11.0; fixed in 1.11.0.

  • CVE-2023-47116Medium 5.3

    Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

    Affected: fixed in 1.11.0.

    Fixed in 1.11.0 (released Jan 30, 2024, 1 day before disclosure).

    The latest release, 1.23.2, is not affected.

  • CVE-2024-23633Medium 4.7

    Label Studio XSS Vulnerability on Data Import

    Affected: fixed in 1.10.1.

    Fixed in 1.10.1 (released Jan 4, 2024, 19 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • Label Studio XSS Vulnerability on Avatar Upload

    Affected: fixed in 1.9.2.

    Fixed in 1.9.2 (released Nov 7, 2023, 77 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio

    Affected: fixed in 1.9.2; fixed in 1.9.2.post0.

    Fixed in 1.9.2.post0 (released Nov 8, 2023, 5 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • CVE-2023-43791Critical 9.8

    Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

    Affected: fixed in 1.8.2.

    Fixed in 1.8.2 (released Aug 29, 2023, 72 days before disclosure).

    The latest release, 1.23.2, is not affected.

  • A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier…

    Affected: fixed in 1.6.0; fixed in 1.5.0.post0.

    Fixed in 1.6.0 (released Sep 27, 2022, 6 days before disclosure).

    The latest release, 1.23.2, is not affected.