CVE-2026-22033
2 advisories.
PyPI/label-studio CVE-2026-22033: high, EPSS 0.28%
Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.22.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-2mq9-hm29-8qch
- https://github.com/HumanSignal/label-studio/security/advisories/GHSA-2mq9-hm29-8qch
- https://nvd.nist.gov/vuln/detail/CVE-2026-22033
- https://github.com/HumanSignal/label-studio/pull/9084
- https://github.com/HumanSignal/label-studio/commit/ea2462bf042bbf370b79445d02a205fbe547b505
- https://github.com/HumanSignal/label-studio
- https://github.com/HumanSignal/label-studio/releases/tag/nightly
CVE-2026-22033 · published · modified · JSON
PyPI/label-studio CVE-2026-22033: unknown, EPSS 0.28%
Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.22.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-1502
- https://github.com/HumanSignal/label-studio/security/advisories/GHSA-2mq9-hm29-8qch
- https://nvd.nist.gov/vuln/detail/CVE-2026-22033
- https://github.com/HumanSignal/label-studio/pull/9084
- https://github.com/HumanSignal/label-studio/commit/ea2462bf042bbf370b79445d02a205fbe547b505
- https://github.com/HumanSignal/label-studio
- https://github.com/HumanSignal/label-studio/releases/tag/nightly
- https://pypi.org/project/label-studio
- https://github.com/advisories/GHSA-2mq9-hm29-8qch
CVE-2026-22033 · published · modified · JSON