{"action":"Upgrade label-studio to 1.10.1 or later.","affected":[{"fixed":"1.10.1","introduced":"0"}],"component":"label-studio","cve_ids":["CVE-2024-23633"],"ecosystem":"PyPI","epss":0.00592,"exploited":false,"fixed_versions":["1.10.1"],"ghsa_id":"GHSA-fq23-g58m-799r","id":"tcs_01M5KFFTH9G3GVP66RZZZ87VM7","modified_at":"2026-09-10T03:49:59.709697205Z","published_at":"2024-01-24T14:21:47Z","references":["https://osv.dev/vulnerability/GHSA-fq23-g58m-799r","https://github.com/HumanSignal/label-studio/security/advisories/GHSA-fq23-g58m-799r","https://nvd.nist.gov/vuln/detail/CVE-2024-23633","https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox","https://github.com/HumanSignal/label-studio","https://github.com/HumanSignal/label-studio/blob/1.9.2.post0/label_studio/data_import/api.py#L595C1-L616C62","https://github.com/HumanSignal/label-studio/blob/1.9.2.post0/label_studio/data_import/uploader.py#L125C5-L146","https://github.com/pypa/advisory-database/tree/main/vulns/label-studio/PYSEC-2024-128.yaml"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-fq23-g58m-799r","url":"https://osv.dev/vulnerability/GHSA-fq23-g58m-799r"}],"summary":"Cross-site Scripting Vulnerability on Data Import"}