Humansignal
Monthly
Cross-tenant cloud storage object access in Label Studio through 1.23.0 allows an authenticated low-privilege user to read other organizations' cloud storage contents by supplying arbitrary file URIs to the proxy_api.py presign and stream endpoints. The root cause is the absence of organization-scoped filters during URI resolution, enabling a tenant in a shared deployment to enumerate and exfiltrate training data, annotations, or source media belonging to other organizations. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the attack is low-complexity and fully automatable once an account is obtained.
Server-side request forgery in Label Studio through 1.23.0 allows authenticated users to route outbound webhook requests to RFC 1918 private addresses and cloud instance metadata endpoints (e.g., 169.254.169.254), bypassing network segmentation controls. By creating a webhook that targets an internal service and enabling payload transmission, an attacker can probe internal infrastructure topology and exfiltrate annotation data to attacker-controlled destinations in the same operation. No public exploit exists at time of analysis, but the patch commit confirms the affected code path in label_studio/webhooks/utils.py and the fix extends SSRF controls to S3 endpoint validation as well.
Cross-organization IDOR in Label Studio allows any authenticated user on a shared instance to read, modify, and delete annotations belonging to other tenants by enumerating sequential integer primary keys. The AnnotationAPI and AnnotationConvertAPI in label_studio/tasks/api.py declare an unscoped queryset (Annotation.objects.all()) and register all annotation permissions against rules.is_authenticated, meaning the organization boundary is never tested at the object level. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects genuinely high confidentiality, integrity, and availability impact on any multi-tenant deployment, and the low exploitation complexity makes the conceptual-to-exploitable gap very small.
Server-side request forgery in HumanSignal Label Studio through 1.24.0.dev0 allows authenticated users to direct the server's import-from-URL endpoint to fetch arbitrary internal addresses, including cloud instance metadata services and RFC-1918 private network hosts. The vulnerability exists because the built-in SSRF mitigation flag `SSRF_PROTECTION_ENABLED` defaults to `false`, leaving all default installations exposed without any additional misconfiguration required. No public exploit code or CISA KEV entry has been identified at time of analysis, but the attack pattern is well-understood and requires only valid credentials and standard HTTP requests.
Stored XSS in Label Studio's custom_hotkeys feature allows authenticated attackers to inject malicious JavaScript that executes in other users' browsers, potentially enabling API token theft and account takeover due to insufficient CSRF protections. Public exploit code exists for this vulnerability affecting Label Studio 1.22.0 and earlier. An attacker could abuse this to gain unauthorized API access or perform actions on behalf of compromised users.
A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. No vendor patch available.
Label Studio is a multi-type data labeling and annotation tool. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Label Studio is an open source data labeling tool. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Label Studio is an open source data labeling tool. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 20.0%.
### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Label Studio is an open source data labeling tool. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Label Studio is a multi-type data labeling and annotation tool with standardized output format. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-tenant cloud storage object access in Label Studio through 1.23.0 allows an authenticated low-privilege user to read other organizations' cloud storage contents by supplying arbitrary file URIs to the proxy_api.py presign and stream endpoints. The root cause is the absence of organization-scoped filters during URI resolution, enabling a tenant in a shared deployment to enumerate and exfiltrate training data, annotations, or source media belonging to other organizations. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the attack is low-complexity and fully automatable once an account is obtained.
Server-side request forgery in Label Studio through 1.23.0 allows authenticated users to route outbound webhook requests to RFC 1918 private addresses and cloud instance metadata endpoints (e.g., 169.254.169.254), bypassing network segmentation controls. By creating a webhook that targets an internal service and enabling payload transmission, an attacker can probe internal infrastructure topology and exfiltrate annotation data to attacker-controlled destinations in the same operation. No public exploit exists at time of analysis, but the patch commit confirms the affected code path in label_studio/webhooks/utils.py and the fix extends SSRF controls to S3 endpoint validation as well.
Cross-organization IDOR in Label Studio allows any authenticated user on a shared instance to read, modify, and delete annotations belonging to other tenants by enumerating sequential integer primary keys. The AnnotationAPI and AnnotationConvertAPI in label_studio/tasks/api.py declare an unscoped queryset (Annotation.objects.all()) and register all annotation permissions against rules.is_authenticated, meaning the organization boundary is never tested at the object level. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects genuinely high confidentiality, integrity, and availability impact on any multi-tenant deployment, and the low exploitation complexity makes the conceptual-to-exploitable gap very small.
Server-side request forgery in HumanSignal Label Studio through 1.24.0.dev0 allows authenticated users to direct the server's import-from-URL endpoint to fetch arbitrary internal addresses, including cloud instance metadata services and RFC-1918 private network hosts. The vulnerability exists because the built-in SSRF mitigation flag `SSRF_PROTECTION_ENABLED` defaults to `false`, leaving all default installations exposed without any additional misconfiguration required. No public exploit code or CISA KEV entry has been identified at time of analysis, but the attack pattern is well-understood and requires only valid credentials and standard HTTP requests.
Stored XSS in Label Studio's custom_hotkeys feature allows authenticated attackers to inject malicious JavaScript that executes in other users' browsers, potentially enabling API token theft and account takeover due to insufficient CSRF protections. Public exploit code exists for this vulnerability affecting Label Studio 1.22.0 and earlier. An attacker could abuse this to gain unauthorized API access or perform actions on behalf of compromised users.
A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. No vendor patch available.
Label Studio is a multi-type data labeling and annotation tool. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Label Studio is an open source data labeling tool. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Label Studio is an open source data labeling tool. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 20.0%.
### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Label Studio is an open source data labeling tool. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Label Studio is a multi-type data labeling and annotation tool with standardized output format. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.