-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly points to the upload_example_using_config function in label_studio/projects/views.py as the location of the XSS. The label_config parameter is taken from the POST request and used to generate task_data. This task_data is then included in an HttpResponse. The provided PoC demonstrates injecting a script via label_config. The commit information shows that the function upload_example_using_config and its corresponding URL route /projects/upload-example/ were entirely removed. This removal is the fix for the vulnerability, confirming that this function was indeed the vulnerable one.
The function playground_replacements is also removed in the patch. While it processes task_data which originates from user input, the primary vulnerability lies in upload_example_using_config directly using the unsanitized input in the HTTP response. playground_replacements itself doesn't seem to introduce the XSS, but rather modifies the data that is later used in the vulnerable response. Since the entire endpoint and its main processing function upload_example_using_config are removed, playground_replacements is removed as it's no longer used in this context. The core vulnerability is the direct use of task_data in HttpResponse within upload_example_using_config.
The other removed code in label_studio/core/all_urls.json and label_studio/projects/urls.py are URL routing configurations that direct requests to the vulnerable upload_example_using_config function. Their removal is part of the mitigation by making the vulnerable endpoint inaccessible.
The removed test file label_studio/tests/sample_tasks.tavern.yml contained tests for the now-deleted upload_example_using_config endpoint, further confirming its role and subsequent removal.
Therefore, the single most direct vulnerable function identified from the patch and description is upload_example_using_config.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| label-studio | pip | < 1.18.0 | 1.18.0 |
Ongoing coverage of React2Shell