HumanSignal vulnerabilities

CVEs per yearBy the year they were published

1. 20232
2. 20244
3. 20255
4. 20266

Newest CVEs

• CVE-2026-121561

  Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads

  HumanSignal · label-studio

  Medium6.3
• CVE-2026-85211

  Label Studio through 1.23.0 Cross-Organization Storage URI Resolution

  HumanSignal · label-studio

  High8.3
• CVE-2026-85179

  Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

  HumanSignal · label-studio

  High8.4
• CVE-2026-76073

  Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset

  HumanSignal · label-studio

  High8.7
• CVE-2026-72560

  HumanSignal Label Studio - Server-Side Request Forgery

  HumanSignal · Label Studio

  Medium6.5
• CVE-2026-22033

  Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field

  HumanSignal · label-studio

  High8.6
• CVE-2025-5173

  HumanSignal label-studio-ml-backend PT File neural_nets.py load deserialization

  HumanSignal · label-studio-ml-backend

  Medium4.8
• CVE-2025-47783

  label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.

  HumanSignal · label-studio

  High7.6
• CVE-2025-25297

  Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

  HumanSignal · label-studio

  High8.6
• CVE-2025-25296

  Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint

  HumanSignal · label-studio

  Medium6.1