{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.22.0"}],"component":"label-studio","cve_ids":["CVE-2026-22033"],"ecosystem":"PyPI","epss":0.00279,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-2mq9-hm29-8qch","id":"tcs_01M5KESVT8RBASYKMFEPN9DJB7","modified_at":"2026-09-10T03:50:32.309655283Z","published_at":"2026-01-12T16:12:50Z","references":["https://osv.dev/vulnerability/GHSA-2mq9-hm29-8qch","https://github.com/HumanSignal/label-studio/security/advisories/GHSA-2mq9-hm29-8qch","https://nvd.nist.gov/vuln/detail/CVE-2026-22033","https://github.com/HumanSignal/label-studio/pull/9084","https://github.com/HumanSignal/label-studio/commit/ea2462bf042bbf370b79445d02a205fbe547b505","https://github.com/HumanSignal/label-studio","https://github.com/HumanSignal/label-studio/releases/tag/nightly"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-2mq9-hm29-8qch","url":"https://osv.dev/vulnerability/GHSA-2mq9-hm29-8qch"}],"summary":"Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field"}