PyPI/label-studio CVE-2023-47115: high 7.1, EPSS 1.45%

Cross-site Scripting Vulnerability on Avatar Upload

Action: Upgrade label-studio to 1.9.2 or later.

pip install label-studio==1.9.2

Affected

Fixed versions

Sources

• osv: GHSA-q68h-xwq5-mm7x
• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-q68h-xwq5-mm7x
• https://nvd.nist.gov/vuln/detail/CVE-2023-47115
• https://github.com/HumanSignal/label-studio/commit/a7a71e594f32ec4af8f3f800d5ccb8662e275da3
• https://docs.djangoproject.com/en/4.2/ref/views/#serving-files-in-development
• https://github.com/HumanSignal/label-studio
• https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/users/functions.py#L18-L49
• https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/users/urls.py#L25-L26
• https://github.com/pypa/advisory-database/tree/main/vulns/label-studio/PYSEC-2024-126.yaml

CVE-2023-47115 · published 2024-01-24T14:21:29Z · modified 2026-09-10T03:50:05.049805535Z · JSON