PatchTheCVECVE-2025-25296: Label Studio is an open source data labeling tool
CVE-2025-25296 is a medium-severity flaw (CVSS 6.1) affecting label studio. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attacker can achieve Cross-Site Scripting (XSS). While the application has a Content Sec
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 1.9% (top 20%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2025-02-14 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: Label Studio < 1.16.0 - Cross-Site Scripting
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-25296?
label studio: upgrade to 1.16.0. Exact commands for each OS are on this page.
Is CVE-2025-25296 being exploited?
CVE-2025-25296 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-25296 affect?
CVE-2025-25296 affects label studio. Severity is medium (CVSS 6.1). Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query par
How urgent is CVE-2025-25296?
Priority 46/100. Public exploit reference
Related CVEs
- CVE-2026-22033 MEDIUM 5.4 UPGRADE Label Studio is a multi-type data labeling and annotation tool
- CVE-2025-47783 MEDIUM 6.1 UPGRADE Label Studio is a multi-type data labeling and annotation tool
- CVE-2025-25297 HIGH 8.6 UPGRADE Label Studio is an open source data labeling tool
- CVE-2024-26152 MEDIUM 4.7 UPGRADE ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properl
- CVE-2024-23633 MEDIUM 4.7 UPGRADE Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from