label-studio@1.10.0 vulnerabilities

label-studio is a Label Studio annotation tool

Affected versions of this package are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') due to improper sanitization of data imported via the file upload feature before rendering within a Choices or Labels tag. An attacker can inject malicious scripts into the web page, which could be executed in the context of the user's browser session by uploading a file containing a payload.

Note:

This is only exploitable if the attacker has permission to use the "data import" function.

Upgrade label-studio to version 1.11.0 or higher.

label-studio is a Label Studio annotation tool

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via the validate_upload_url function. An attacker can bypass SSRF protections (SSRF_PROTECTION_ENABLED) and access internal web servers, potentially compromising the confidentiality of those servers by using HTTP redirection or performing a DNS rebinding attack.

Upgrade label-studio to version 1.11.0 or higher.

label-studio is a Label Studio annotation tool

Affected versions of this package are vulnerable to Cross-site Scripting via the remote import feature which allowed users to import data from a remote web source. An attacker can execute malicious JavaScript code in the context of the website by crafting a payload that, when visited, performs unauthorized actions such as adding a new super administrator user.

Note:

If an attacker can craft a JavaScript payload that adds a new Django Super Administrator user if a Django administrator visits the image. This may highly impact the subsequent system.

Upgrade label-studio to version 1.10.1 or higher.