CVE-2025-25296 Scanner

Label Studio is a widely used open-source data labeling tool employed by researchers, developers, and data scientists for creating structured datasets from raw data. It is typically deployed in environments focusing on machine learning model training and development. Label Studio provides a web interface where users can create, visualize, and manage labeling projects. Users can customize labeling tasks and review the accuracy of labeled data. The platform supports various data types, including image, text, and audio. Its flexibility and integration capabilities make it a favored choice in research and applied AI tasks.

Cross-Site Scripting (XSS) is a type of vulnerability that occurs when an application includes user-supplied data in web pages without properly validating or encoding it. In this specific instance, Label Studio versions prior to 1.16.0 are vulnerable to XSS due to unsanitized HTML rendering in the '/projects/upload-example' endpoint. This potentially allows attackers to execute arbitrary JavaScript in the victim's browser. The exploit depends on tricking users into visiting a crafted URL. As a result, this vulnerability can lead to unauthorized actions being performed on behalf of the victim.

The vulnerability in Label Studio is technically present in the '/projects/upload-example' endpoint. It specifically arises when user-generated HTML is not properly sanitized before rendering, allowing for the execution of arbitrary JavaScript. The attack vector involves crafting a malicious 'label_config' parameter within a GET request. Successful exploitation requires some social engineering to lure users into clicking a crafted URL. The attack payload is triggered within the browser, leading to potential consequences for user sessions and data security.

If exploited, this XSS vulnerability allows attackers to execute scripts in the context of the victim's browser session. Potential effects include session hijacking, where attackers can impersonate the victim, data theft such as extracting sensitive information from web pages, and spreading malware through further injected scripts. It can also lead to exploitation of additional vulnerabilities within the victim's network or systems by redirecting them to malicious sites.

REFERENCES

• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-wpq5-3366-mqw4
• https://nvd.nist.gov/vuln/detail/CVE-2025-25296