{"action":"Upgrade label-studio to 1.5.0.post0 or later.","affected":[{"fixed":"1.5.0.post0","introduced":"0"}],"component":"label-studio","cve_ids":["CVE-2022-36551"],"ecosystem":"PyPI","epss":0.0689,"exploited":false,"fixed_versions":["1.5.0.post0"],"ghsa_id":"GHSA-pc6f-259w-w3j6","id":"tcs_01M5KGH332D60TBT99F3QTPM99","modified_at":"2026-06-10T17:02:01.863971823Z","published_at":"2022-10-03T12:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-300","http://heartex.com","http://labelstud.io","https://github.com/heartexlabs/label-studio/pull/2840","https://github.com/advisories/GHSA-pc6f-259w-w3j6"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-300","url":"https://osv.dev/vulnerability/PYSEC-2022-300"}],"summary":"A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the syst"}