Stored XSS Vulnerability in Label Studio by HumanSignal

CVE-2026-22033

What is CVE-2026-22033?

Label Studio, a multi-type data labeling and annotation tool, has a persistent stored cross-site scripting vulnerability in its custom_hotkeys functionality. This flaw allows an authenticated attacker or one who manipulates a user to update their custom_hotkeys, to inject malicious JavaScript code. When exploited, this script executes in the browsers of other users accessing pages that utilize the templates/base.html template. The application exposes an API token endpoint and lacks sufficient CSRF protection across certain API endpoints. Hence, the injected script can potentially fetch a victim's API token or execute token reset commands, possibly leading to complete account takeover and unauthorized access to API resources.

References