Executive brief
Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint
Affected products
- PyPI label-studio
Junglewise Threat Intelligence
CVE-2025-25296: PYSEC-2026-1504 - Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint
CVE-2025-25296 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: label-studio (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1502 - Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field
- PYSEC-2026-1503 - Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint
- HumanSignal Label Studio reflected XSS in label_config parameter
- PYSEC-2024-249 - ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being ren
- PYSEC-2024-127 - Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tes