https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-22033.htmlhttps://patchthecve.com/cve/CVE-2026-22033.htmlWed, 17 Jun 2026 10:19:23 +0000MEDIUM 5.4: Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in the custom_hotkeys functionality of the application. An authenticated attacker (or one who can trick a user/administrator into updating their https://patchthecve.com/cve/CVE-2025-5173.htmlhttps://patchthecve.com/cve/CVE-2025-5173.htmlWed, 17 Jun 2026 09:47:23 +0000MEDIUM 5.3: A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py of the componhttps://patchthecve.com/cve/CVE-2025-47783.htmlhttps://patchthecve.com/cve/CVE-2025-47783.htmlWed, 17 Jun 2026 09:28:41 +0000MEDIUM 6.1: Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attacks. https://patchthecve.com/cve/CVE-2025-25297.htmlhttps://patchthecve.com/cve/CVE-2025-25297.htmlWed, 17 Jun 2026 09:00:38 +0000HIGH 8.6: Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery (SSRF) vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a custohttps://patchthecve.com/cve/CVE-2025-25296.htmlhttps://patchthecve.com/cve/CVE-2025-25296.htmlWed, 17 Jun 2026 09:00:38 +0000MEDIUM 6.1: Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting a specially formatted XML label config whttps://patchthecve.com/cve/CVE-2024-26152.htmlhttps://patchthecve.com/cve/CVE-2024-26152.htmlWed, 17 Jun 2026 07:17:12 +0000MEDIUM 4.7: ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Choices`](https://labelstud.io/tags/choices) or [`Labels`](https://labelstud.io/tags/labels) tag, resulting in an XSS vulnerability. ### Detaihttps://patchthecve.com/cve/CVE-2023-47116.htmlhttps://patchthecve.com/cve/CVE-2023-47116.htmlWed, 17 Jun 2026 06:32:11 +0000MEDIUM 5.3: Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the `SSRF_PROTECTION_ENABLED` environment variable can be bypassed to acceshttps://patchthecve.com/cve/CVE-2024-23633.htmlhttps://patchthecve.com/cve/CVE-2024-23633.htmlWed, 17 Jun 2026 07:13:16 +0000MEDIUM 4.7: Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious JavaShttps://patchthecve.com/cve/CVE-2023-47115.htmlhttps://patchthecve.com/cve/CVE-2023-47115.htmlWed, 17 Jun 2026 06:32:10 +0000HIGH 7.1: Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting (XSS) vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary