Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attacks. The vulnerability is reproducible when sending a properly formatted request to the `POST /projects/upload-example/` endpoint. In the source code, the vulnerability is located at `label_studio/projects/views.py`. Version 1.18.0 contains a patch for the issue.

Label Studio versions prior to 1.18.0 are vulnerable to a Reflected Cross-Site Scripting on '/projects/upload-example/' endpoint. This detection is included in the AI and LLM category.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to
    1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to
    data theft, session hijacking, unauthorized actions on behalf of the user, and other attacks. The
    vulnerability is reproducible when sending a properly formatted request to the `POST /projects/upload-
    example/` endpoint. In the source code, the vulnerability is located at `label_studio/projects/views.py`.
    Version 1.18.0 contains a patch for the issue. (CVE-2025-47783)

ID	Name	Product	Family	Type	Severity
114798	Label Studio < 1.18.0 Reflected Cross-Site Scripting	Web App Scanning	Artificial Intelligence	Check Based	high
426279	SCA: security update for label-studio (GHSA-8jhr-wpcm-hh4h)	Tenable Cloud Security	SCA Checks	Local	high
426279	SCA: security update for label-studio (GHSA-8jhr-wpcm-hh4h)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-47783

high

Tenable Plugins

high

high

high