PyPI/label-studio CVE-2023-47116: medium 5.3, EPSS 0.74%

Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections

Action: Upgrade label-studio to 1.11.0 or later.

pip install label-studio==1.11.0

Affected

Fixed versions

Sources

• osv: GHSA-p59w-9gqw-wj8r
• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-p59w-9gqw-wj8r
• https://nvd.nist.gov/vuln/detail/CVE-2023-47116
• https://github.com/HumanSignal/label-studio/commit/55dd6af4716b92f2bb213fe461d1ffbc380c6a64
• https://en.wikipedia.org/wiki/DNS_rebinding
• https://github.com/HumanSignal/label-studio
• https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/core/utils/io.py#L174-L209
• https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/data_import/uploader.py#L127-L155
• https://github.com/HumanSignal/label-studio/releases/tag/1.11.0
• https://github.com/pypa/advisory-database/tree/main/vulns/label-studio/PYSEC-2024-127.yaml

CVE-2023-47116 · published 2024-01-31T18:04:40Z · modified 2026-09-10T03:50:05.055225353Z · JSON