CVE-2026-22033— Label Studio 访问控制错误漏洞

Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field

Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in the custom_hotkeys functionality of the application. An authenticated attacker (or one who can trick a user/administrator into updating their custom_hotkeys) can inject JavaScript code that executes in other users’ browsers when those users load any page using the templates/base.html template. Because the application exposes an API token endpoint (/api/current-user/token) to the browser and lacks robust CSRF protection on some API endpoints, the injected script may fetch the victim’s API token or call token reset endpoints — enabling full account takeover and unauthorized API access.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Label Studio 访问控制错误漏洞

Label Studio是Heartex开源的一个开源数据标注工具。允许您使用简单明了的 UI 标记音频、文本、图像、视频和时间序列等数据类型，并导出为各种模型格式。 Label Studio 1.22.0及之前版本存在访问控制错误漏洞，该漏洞源于custom_hotkeys功能存在存储型跨站脚本，可能导致经过身份验证的攻击者注入JavaScript代码，进而实现账户接管和未经授权的API访问。

N/A

N/A