CVE-2024-23633
2 advisories.
PyPI/label-studio CVE-2024-23633: medium 4.7, EPSS 0.59%
Cross-site Scripting Vulnerability on Data Import
Action: Upgrade label-studio to 1.10.1 or later.
pip install label-studio==1.10.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.10.1 | - |
Fixed versions
| 1.10.1 |
Sources
- osv: GHSA-fq23-g58m-799r
- https://github.com/HumanSignal/label-studio/security/advisories/GHSA-fq23-g58m-799r
- https://nvd.nist.gov/vuln/detail/CVE-2024-23633
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
- https://github.com/HumanSignal/label-studio
- https://github.com/HumanSignal/label-studio/blob/1.9.2.post0/label_studio/data_import/api.py#L595C1-L616C62
- https://github.com/HumanSignal/label-studio/blob/1.9.2.post0/label_studio/data_import/uploader.py#L125C5-L146
- https://github.com/pypa/advisory-database/tree/main/vulns/label-studio/PYSEC-2024-128.yaml
CVE-2024-23633 · published · modified · JSON
PyPI/label-studio CVE-2024-23633: medium 6.1, EPSS 0.59%
Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to vers
Action: Upgrade label-studio to 1.10.1 or later.
pip install label-studio==1.10.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.10.1 | - |
Fixed versions
| 1.10.1 |
Sources
- osv: PYSEC-2024-128
- https://github.com/HumanSignal/label-studio/security/advisories/GHSA-fq23-g58m-799r
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
- https://github.com/HumanSignal/label-studio/blob/1.9.2.post0/label_studio/data_import/api.py#L595C1-L616C62
- https://github.com/HumanSignal/label-studio/blob/1.9.2.post0/label_studio/data_import/uploader.py#L125C5-L146
CVE-2024-23633 · published · modified · JSON