Label Studio

Cross-organization IDOR in Label Studio allows any authenticated user on a shared instance to read, modify, and delete annotations belonging to other tenants by enumerating sequential integer primary keys. The AnnotationAPI and AnnotationConvertAPI in label_studio/tasks/api.py declare an unscoped queryset (Annotation.objects.all()) and register all annotation permissions against rules.is_authenticated, meaning the organization boundary is never tested at the object level. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects genuinely high confidentiality, integrity, and availability impact on any multi-tenant deployment, and the low exploitation complexity makes the conceptual-to-exploitable gap very small.

Server-side request forgery in HumanSignal Label Studio through 1.24.0.dev0 allows authenticated users to direct the server's import-from-URL endpoint to fetch arbitrary internal addresses, including cloud instance metadata services and RFC-1918 private network hosts. The vulnerability exists because the built-in SSRF mitigation flag `SSRF_PROTECTION_ENABLED` defaults to `false`, leaving all default installations exposed without any additional misconfiguration required. No public exploit code or CISA KEV entry has been identified at time of analysis, but the attack pattern is well-understood and requires only valid credentials and standard HTTP requests.

Stored XSS in Label Studio's custom_hotkeys feature allows authenticated attackers to inject malicious JavaScript that executes in other users' browsers, potentially enabling API token theft and account takeover due to insufficient CSRF protections. Public exploit code exists for this vulnerability affecting Label Studio 1.22.0 and earlier. An attacker could abuse this to gain unauthorized API access or perform actions on behalf of compromised users.

Label Studio is a multi-type data labeling and annotation tool. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Label Studio is an open source data labeling tool. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Label Studio is an open source data labeling tool. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 20.0%.

### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Label Studio is an open source data labeling tool. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Label Studio is a multi-type data labeling and annotation tool with standardized output format. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.