{"items":[{"id":"NVI-00018345","kind":"vulnerability","title":"label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-8jhr-wpcm-hh4h","CVE-2025-47783"],"plain_summary":"GitHub lists this reviewed advisory for label-studio. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1428a4a3eb82463fbe8ce30b197302c9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1428a4a3eb82463fbe8ce30b197302c9","url":"https://github.com/advisories/GHSA-8jhr-wpcm-hh4h","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-8jhr-wpcm-hh4h","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:52:42.537Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1428a4a3eb82463fbe8ce30b197302c9"],"technology":"label-studio","known_exclusions":[],"conditions_summary":"### Summary\nThe vulnerability allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, unauthorized actions on behalf of the user, and other attacks.\n\n### Details\nThe vulnerability is reproducible when sending a properly formatted request to the `POST /projects/upload-example/` endpoint. In the source code, the vulnerability is located at `label_studio/projects/views.py`.\n```python\n39: @require_http_methods(['POST'])\n40: def upload_example_using_config(request):\n41:     \"\"\"Generate upload data example by config only\"\"\"\n42:     config = request.POST.get('label_config', '')\n43: \n44:     org_pk = get_organization_from_request(request)\n45:     secure_mode = False\n46:     if org_pk is not None:\n47:         org = generics.get_object_or_404(Organization, pk=org_pk)\n48:         secure_mode = org.secure_mode\n49: \n50:     try:\n51:         Project.validate_label_config(config)\n52:         task_data, _, _ = get_sample_task(config, secure_mode)\n53:         task_data = playground_replacements(request, task_data)\n54:     except (ValueError, ValidationError, lxml.etree.Error):\n55:         response = HttpResponse('error while example generating',","public_affected_ranges":["< 1.18.0"]}],"null_published_at":"2026-11-07T07:07:39.820Z","source_updated_at":"2026-06-06T00:31:25.000Z","source_disclosed_at":"2025-05-15T16:21:16.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:52:42.537Z"}],"next_cursor":null,"snapshot_revision":"42594"}