Summary
Summary
On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a Choices or Labels tag, resulting in an XSS vulnerability.
Details
Need permission to use the "data import" function. This was reproduced on Label Studio 1.10.1.
PoC
-
Create a project.
-
Upload a file containing the payload using the "Upload Files" function.
The following are the contents of the files used in the PoC
{
"data": {
"prompt": "labelstudio universe image",
"images": [
{
"value": "id123#0",
"style": "margin: 5px",
"html": "<img width='400' src='https://labelstud.io/_astro/images-tab.64279c16_ZaBSvC.avif' onload=alert(document.cookie)>"
}
]
}
}-
Select the text-to-image generation labeling template of Ranking and scoring
-
Select a task
-
Check that the script is running
Impact
Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | label-studio | < 1.11.0 | 1.11.0 |
Referencias
- https://github.com/HumanSignal/label-studio/security/advisories/GHSA-6xv9-957j-qfhg
- https://nvd.nist.gov/vuln/detail/CVE-2024-26152
- https://github.com/HumanSignal/label-studio/pull/5232
- https://github.com/HumanSignal/label-studio/commit/5df9ae3828b98652e9fa290a19f4deedf51ef6c8
- https://github.com/HumanSignal/label-studio
- https://github.com/HumanSignal/label-studio/releases/tag/1.11.0
- https://github.com/pypa/advisory-database/tree/main/vulns/label-studio/PYSEC-2024-249.yaml
- https://github.com/advisories/GHSA-6xv9-957j-qfhg
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Debilidad (CWE)
CWE-79- Plataforma
- Python (PyPI)
- Paquete
label-studio- Publicada
- 22.02.2024
- Actualizado
- 11.10.2026 12:20
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-6xv9-957j-qfhg - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2024-249 - PyPA Advisory Database; CC BY 4.0
Historial de vulnerabilidades: label-studio
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 12
- Primera → última
- 10.2022 01.2026
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 7
- Media 4
Divulgaciones por año
- 2022: 1
- 2023: 3
- 2024: 4
- 2025: 3
- 2026: 1
-
Summary esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.