PatchTheCVECVE-2024-23633: Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from
CVE-2024-23633 is a medium-severity flaw (CVSS 4.7) affecting label studio. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious JavaScript code in the context of the Label Studio website. Executing arbitrary JavaScript could result in an attacker performing malicious actions on Labe
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.7 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.6% (top 52%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2024-01-24 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-23633?
label studio: upgrade to 1.10.1. Exact commands for each OS are on this page.
Is CVE-2024-23633 being exploited?
CVE-2024-23633 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-23633 affect?
CVE-2024-23633 affects label studio. Severity is medium (CVSS 4.7). Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been
How urgent is CVE-2024-23633?
Priority 29/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-22033 MEDIUM 5.4 UPGRADE Label Studio is a multi-type data labeling and annotation tool
- CVE-2025-47783 MEDIUM 6.1 UPGRADE Label Studio is a multi-type data labeling and annotation tool
- CVE-2025-25297 HIGH 8.6 UPGRADE Label Studio is an open source data labeling tool
- CVE-2025-25296 MEDIUM 6.1 UPGRADE Label Studio is an open source data labeling tool
- CVE-2024-26152 MEDIUM 4.7 UPGRADE ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properl