PT-2025-7075 · Unknown · Label Studio

Xbow-Security · Published 2025-02-14 · Updated 2025-08-25 · CVE-2025-25296

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Label Studio versions prior to 1.16.0

Description: The issue allows injection of arbitrary HTML through a GET request with an appropriately crafted label config query parameter at the /projects/upload-example endpoint. This enables Cross-Site Scripting (XSS) by rendering user-provided HTML content without proper sanitization. Although the application has a Content Security Policy (CSP), it is ineffective in preventing script execution because it is set in report-only mode. The vulnerability can be exploited by getting victims to visit a maliciously crafted URL, potentially allowing theft of sensitive data, session hijacking, or other malicious actions.

Recommendations: For versions prior to 1.16.0, update to version 1.16.0 or later to resolve the issue. As a temporary workaround, consider enabling the Content Security Policy in enforcement mode instead of report-only mode to actively block unauthorized script execution. Restrict access to the /projects/upload-example endpoint to minimize the risk of exploitation. Avoid using the label config query parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-25296

GHSA-WPQ5-3366-MQW4

Affected Products

Label Studio

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25296.json · Exploit
• https://github.com/HumanSignal/label-studio/commit/8cf6958e1e27ef6a03ed287e674470975d340885 · Patch
• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-wpq5-3366-mqw4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25296 · Security Note
• https://osv.dev/vulnerability/GHSA-wpq5-3366-mqw4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25296 · Vendor Advisory
• https://github.com/HumanSignal/label-studio · Note
• https://t.me/cvedetector/18140 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1890499823121350753 · Twitter Post
• https://twitter.com/CVEnew/status/1890524756681847024 · Twitter Post
• https://t.me/cveNotify/133296 · Telegram Post