CVE-2023-43791 Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

What is CVE-2023-43791?

CVE-2023-43791 is a critical vulnerability in HumanSignal label-studio, published on 9 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Leak vulnerability to impersonate any account on Label Studio. An attacker could exploit these vulnerabilities to escalate their privileges from a low privilege user to a Django Super Administrator user. The vulnerability was found to affect versions before `1.8.2`, where a patch was introduced.

Weakness: CWE-200

Which versions are affected by CVE-2023-43791?

3 open source packages ship an affected version, including label-studio. It affects 1 product.

Products include Humansignal Label Studio.

How do I fix CVE-2023-43791?

Upgrade label-studio to 1.8.2 or later.

Is CVE-2023-43791 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-43791 exists.

Other vulnerabilities in HumanSignal label-studio

• CVE-2026-22033 Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field High 8.6
• CVE-2025-25297 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint High 8.6
• CVE-2025-47783 label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter. High 7.6
• CVE-2023-47117 Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio High 7.5
• CVE-2023-47115 Label Studio XSS Vulnerability on Avatar Upload High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f475-x83m-rx5m, PYSEC-2023-274.