PyPI/label-studio CVE-2024-26152: medium 4.7, EPSS 2.22%

Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config

Action: Upgrade label-studio to 1.11.0 or later.

pip install label-studio==1.11.0

Affected

Fixed versions

Sources

• osv: GHSA-6xv9-957j-qfhg
• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-6xv9-957j-qfhg
• https://nvd.nist.gov/vuln/detail/CVE-2024-26152
• https://github.com/HumanSignal/label-studio/pull/5232
• https://github.com/HumanSignal/label-studio/commit/5df9ae3828b98652e9fa290a19f4deedf51ef6c8
• https://github.com/HumanSignal/label-studio
• https://github.com/HumanSignal/label-studio/releases/tag/1.11.0
• https://github.com/pypa/advisory-database/tree/main/vulns/label-studio/PYSEC-2024-249.yaml

CVE-2024-26152 · published 2024-02-22T21:52:57Z · modified 2026-06-10T17:14:16.370035786Z · JSON