Humansignal
Humansignal Label Studio: vulnerabilidades y CVE
Humansignal Label Studio tiene 11 vulnerabilidades publicadas, 2 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE11
Últimos 12 meses2
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-72560 | Media (6.5) | 0.34% | — | 11 ago 2026 | A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL… |
| CVE-2026-22033 | Alta (8.6) | 0.28% | — | 12 ene 2026 | Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in the custom_hotkeys functionality of the application. An… |
| CVE-2025-47783 | Alta (7.6) | 0.59% | — | 14 may 2025 | Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft,… |
| CVE-2025-25297 | Alta (7.7) | 0.67% | — | 14 feb 2025 | Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery (SSRF) vulnerability in its endpoint configuration. When… |
| CVE-2025-25296 | Media (6.1) | 1.9% | — | 14 feb 2025 | Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted… |
| CVE-2024-26152 | Media (6.1) | 2.2% | — | 22 feb 2024 | ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Choices`](https://labelstud.io/tags/choices) or… |
| CVE-2023-47116 | Media (5.3) | 0.74% | — | 31 ene 2024 | Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by… |
| CVE-2024-23633 | Media (6.1) | 0.59% | — | 24 ene 2024 | Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this… |
| CVE-2023-47115 | Media (5.4) | 1.4% | — | 23 ene 2024 | Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting (XSS) vulnerability that could be exploited when an authenticated user uploads a crafted image file for… |
| CVE-2023-47117 | Alta (7.5) | 4.1% | — | 13 nov 2023 | Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a… |
| CVE-2023-43791 | Alta (8.8) | 1.2% | — | 9 nov 2023 | Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio.… |