Executive brief
Label Studio is a data labeling and annotation platform used for machine learning projects. An authenticated attacker can inject malicious JavaScript code into user hotkey settings, which then executes in other users' browsers when they view any page. This allows the attacker to steal API tokens and reset passwords, enabling full account takeover and unauthorized access to the entire platform and its data.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the custom_hotkeys field of the user profile. The application renders user-controlled hotkey configuration in templates/base.html using Django's |safe filter without proper escaping, allowing closing </script> sequences to be injected. An authenticated attacker can craft a malicious JSON payload via PATCH /api/users/{id}/ to update the custom_hotkeys field with JavaScript code. When other users load any page using the base template, the injected script executes in their browser context and can call the unprotected /api/current-user/token endpoint to fetch the victim's API token, or trigger token reset endpoints. The vulnerability requires authentication to inject the payload but can affect any user who views a page after the injection.
Affected products
- HumanSignal Label Studio 0.x through 1.22.0
Timeline
- 2026-01-12: disclosed
- 2026-01-12: advisory: GHSA-2mq9-hm29-8qch published