CVE-2026-22033: Label Studio stored XSS in custom_hotkeys with account takeover

CVE-2026-22033 · Severity: medium · CVSS 4 · Published 2026-07-07

Label Studio is a data labeling and annotation platform used for machine learning projects. An authenticated attacker can inject malicious JavaScript code into user hotkey settings, which then executes in other users' browsers when they view any page. This allows the attacker to steal API tokens and reset passwords, enabling full account takeover and unauthorized access to the entire platform and its data.

Technologies: label-studio (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-22033 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22033 being exploited in the wild.
How severe is CVE-2026-22033?
Medium severity, with a CVSS score of 4, published 7 July 2026.
Which products and versions are affected?
label-studio (PyPI) ECOSYSTEM:introduced=0,last_affected=1.22.0.
Is there a fix for CVE-2026-22033?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-22033 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-22033?
Check whether you run label-studio (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the custom_hotkeys field of the user profile. The application renders user-controlled hotkey configuration in templates/base.html using Django's |safe filter without proper escaping, allowing closing </script> sequences to be injected. An authenticated attacker can craft a malicious JSON payload via PATCH /api/users/{id}/ to update the custom_hotkeys field with JavaScript code. When other users load any page using the base template, the injected script executes in their browser context and can call the unprotected /api/current-user/token endpoint to fetch the victim's API token, or trigger token reset endpoints. The vulnerability requires authentication to inject the payload but can affect any user who views a page after the injection.

Affected products

  • HumanSignal Label Studio 0.x through 1.22.0

Identifiers

  • CVE-2026-22033
  • GHSA-2mq9-hm29-8qch
  • PYSEC-2026-1502

Timeline

  • 2026-01-12: disclosed
  • 2026-01-12: advisory: GHSA-2mq9-hm29-8qch published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.