PyPI/label-studio CVE-2026-22033: high, EPSS 0.28%

Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-2mq9-hm29-8qch
• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-2mq9-hm29-8qch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22033
• https://github.com/HumanSignal/label-studio/pull/9084
• https://github.com/HumanSignal/label-studio/commit/ea2462bf042bbf370b79445d02a205fbe547b505
• https://github.com/HumanSignal/label-studio
• https://github.com/HumanSignal/label-studio/releases/tag/nightly

CVE-2026-22033 · published 2026-01-12T16:12:50Z · modified 2026-09-10T03:50:32.309655283Z · JSON