/Vulnerability Library

Label Studio < 1.16.0 - Cross-Site Scripting

CVE-2025-25296
Verified

Description

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted label_config in a GET request, exploit requires victims to visit malicious URL.

Severity

Medium

CVSS Score

5.4

Exploit Probability

2%

Affected Product

label-studio

Published Date

June 8, 2026

Template Author

0x_akoko

CVE-2025-25296.yaml
5.4Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVE ID:
cve-2025-25296
CWE ID:
cwe-79

References

https://github.com/HumanSignal/label-studio/security/advisories/GHSA-wpq5-3366-mqw4https://nvd.nist.gov/vuln/detail/CVE-2025-25296

Remediation Steps

Update to version 1.16.0 or later to patch the vulnerability.