PT-2025-22915 · Humansignal · Label-Studio-Ml-Backend

Ybdesire · Published 2025-05-26 · Updated 2025-05-26 · CVE-2025-5173

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HumanSignal label-studio-ml-backend versions up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf

Description A vulnerability has been found in the function load of the file label-studio-ml-backend/label studio ml/examples/yolo/utils/neural nets.py of the component PT File Handler. The manipulation of the argument path leads to deserialization. An attack has to be approached locally. This product takes the approach of rolling releases to provide continuous delivery.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-5173

GHSA-55G9-6C2X-GF8Q

Affected Products

Label-Studio-Ml-Backend

References · 11

• https://github.com/HumanSignal/label-studio-ml-backend/issues/765 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-5173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5173 · Security Note
• https://osv.dev/vulnerability/GHSA-55g9-6c2x-gf8q · Vendor Advisory
• https://github.com/HumanSignal/label-studio-ml-backend · Note
• https://vuldb.com/?ctiid.310261 · Note
• https://vuldb.com/?submit.578126 · Note
• https://vuldb.com/?id.310261 · Note
• https://t.me/cvenotify/123608 · Telegram Post
• https://twitter.com/CVEnew/status/1926894080442732844 · Twitter Post
• https://t.me/cvetracker/24624 · Telegram Post