Cross-Site Scripting Vulnerability in Label Studio by HumanSignal
CVE-2025-47783

7.6HIGH

Key Information:

Vendor

Humansignal

Status
Label-studio
Vendor
CVE Published:
14 May 2025

What is CVE-2025-47783?

Label Studio, a versatile data labeling and annotation tool, contains a vulnerability that permits attackers to inject malicious scripts through the POST /projects/upload-example/ endpoint. This can compromise user data, enabling data theft, session hijacking, and unauthorized actions executed on behalf of the user. The flaw exists in versions prior to 1.18.0 and is addressed in this update, which reinforces the security framework of the application.

Affected Version(s)

label-studio < 1.18.0

References

https://github.com/HumanSignal/label-studio/security/advi...
x_refsource_CONFIRM

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

.