What is CVE-2025-25296?

CVE-2025-25296 is a medium-severity vulnerability in Humansignal Label-Studio, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-02-14.

How severe is CVE-2025-25296?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Is CVE-2025-25296 known to be exploited?

5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Humansignal Label-Studio

CVE-2025-25296

Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attacker can achieve Cross-Site Scripting (XSS). While the application has a Content Security Policy (CSP), it is only set in report-only mode, making it ineffective at preventing script execution. The vulnerability exists because the upload-example endpoint renders user-provided HTML content without proper sanitization on a GET request. This allows attackers to inject and execute arbitrary JavaScript in victims' browsers by getting them to visit a maliciously crafted URL. This is considered vulnerable because it enables attackers to execute JavaScript in victims' contexts, potentially allowing theft of sensitive data, session hijacking, or other malicious actions. Version 1.16.0 contains a patch for the issue.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.019 (78.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Humansignal Label-studio — versions < 1.16.0
Humansignal Label_studio

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-25296?: CVE-2025-25296 is a medium-severity vulnerability in Humansignal Label-Studio, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-02-14.
How severe is CVE-2025-25296?: Medium severity. CVSS v3 base score is 6.1 out of 10.
Is CVE-2025-25296 known to be exploited?: 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.