CVE-2025-25296
2 advisories.
PyPI/label-studio CVE-2025-25296: medium 6.1, EPSS 1.90%
Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint
Action: Upgrade label-studio to 1.16.0 or later.
pip install label-studio==1.16.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.16.0 | - |
Fixed versions
| 1.16.0 |
Sources
- osv: GHSA-wpq5-3366-mqw4
- https://github.com/HumanSignal/label-studio/security/advisories/GHSA-wpq5-3366-mqw4
- https://nvd.nist.gov/vuln/detail/CVE-2025-25296
- https://github.com/HumanSignal/label-studio/commit/8cf6958e1e27ef6a03ed287e674470975d340885
- https://github.com/HumanSignal/label-studio
CVE-2025-25296 · published · modified · JSON
PyPI/label-studio CVE-2025-25296: medium 6.1, EPSS 1.90%
Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint
Action: Upgrade label-studio to 1.16.0 or later.
pip install label-studio==1.16.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.16.0 | - |
Fixed versions
| 1.16.0 |
Sources
- osv: PYSEC-2026-1504
- https://github.com/HumanSignal/label-studio/security/advisories/GHSA-wpq5-3366-mqw4
- https://nvd.nist.gov/vuln/detail/CVE-2025-25296
- https://github.com/HumanSignal/label-studio/commit/8cf6958e1e27ef6a03ed287e674470975d340885
- https://github.com/HumanSignal/label-studio
- https://pypi.org/project/label-studio
- https://github.com/advisories/GHSA-wpq5-3366-mqw4
CVE-2025-25296 · published · modified · JSON