PyPI/label-studio CVE-2025-25297: high 8.6, EPSS 0.67%

Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint

Action: Upgrade label-studio to 1.16.0 or later.

pip install label-studio==1.16.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1503
• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-m238-fmcw-wh58
• https://nvd.nist.gov/vuln/detail/CVE-2025-25297
• https://github.com/HumanSignal/label-studio/commit/06a2b29c1208e1878ccae66e6b84c8b24598fa79
• https://github.com/HumanSignal/label-studio
• https://pypi.org/project/label-studio
• https://github.com/advisories/GHSA-m238-fmcw-wh58

CVE-2025-25297 · published 2026-07-07T14:34:49.760107Z · modified 2026-07-07T17:47:16.343990453Z · JSON