VulnSocial

CVE-2025-25296Disclosure(humansignal / label_studio)

LOWCVSS 6.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attacker can achieve Cross-Site Scripting (XSS). While the application has a Content Security Policy (CSP), it is only set in report-only mode, making it ineffective at preventing script execution. The vulnerability exists because the upload-example endpoint renders user-provided HTML content without proper sanitization on a GET request. This allows attackers to inject and execute arbitrary JavaScript in victims' browsers by getting them to visit a maliciously crafted URL. This is considered vulnerable because it enables attackers to execute JavaScript in victims' contexts, potentially allowing theft of sensitive data, session hijacking, or other malicious actions. Version 1.16.0 contains a patch for the issue.

humansignal CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • label_studio

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
humansignal
Products
label_studio

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-06-11: 1Technical Details · 2026-06-11: 106-11
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2025-25296 - medium 🚨 Label Studio < 1.16.0 - Cross-Site Scripting > Label Studio prior to version 1.16.0 contains a cross-site scripting caused by render... 👾 https://cloud.projectdiscovery.io/library/CVE-2025-25296 @pdnuclei #NucleiTemplates #cve

    Post summary

    The text announces CVE‑2025‑25296, a medium‑severity cross‑site scripting vulnerability affecting Label Studio versions prior to 1.16.0. No PoC, exploit code, active exploitation, or patch information is provided.

    0000094
    958 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apphumansignallabel_studio---

Explore more

Back to dashboardhumansignal CVEslabel_studio vulnerabilities