{"answers":{"affected":"3 open source packages ship an affected version, including label-studio. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25297 exists.","fix":"Upgrade label-studio to 1.16.0 or later.","what":"CVE-2025-25297 is a high-severity server-side request forgery vulnerability in HumanSignal label-studio, published on 14 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-25297 and fix it if it is affected.\n\nWhat it is: CVE-2025-25297 is a high-severity server-side request forgery vulnerability in HumanSignal label-studio, published on 14 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25297 exists.\n\nAffected packages and fixed versions:\n- label-studio (PyPI): affected all versions; fixed in 1.16.0\n- label-studio (PyPI): affected all versions; fixed in 1.16.0\n- label-studio (PyPI): affected all versions; fixed in 1.16.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-25297/ (Markdown: https://insights.sbomify.com/CVE-2025-25297/index.md)","id":"CVE-2025-25297","markdown":"https://insights.sbomify.com/CVE-2025-25297/index.md","name":"CVE-2025-25297","record":{"aliases":["GHSA-m238-fmcw-wh58","PYSEC-2026-1503"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Data labeling tool","requires_auth":"none","summary":"Attackers can exploit an SSRF vulnerability in the S3 storage configuration to access internal services and exfiltrate data via error messages.","user_interaction":"not_required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"label_studio","vendor":"humansignal"}],"cvss":{"score":8.6,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"description":"Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery (SSRF) vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a custom S3 endpoint URL via the s3_endpoint parameter. This endpoint URL is passed directly to the boto3 AWS SDK without proper validation or restrictions on the protocol or destination. The vulnerability allows an attacker to make the application send HTTP requests to arbitrary internal services by specifying them as the S3 endpoint. When the storage sync operation is triggered, the application attempts to make S3 API calls to the specified endpoint, effectively making HTTP requests to the target service and returning the response in error messages. This SSRF vulnerability enables attackers to bypass network segmentation and access internal services that should not be accessible from the external network. The vulnerability is particularly severe because error messages from failed requests contain the full response body, allowing data exfiltration from internal services. Version 1.16.0 contains a patch for the issue.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint","id":"CVE-2025-25297","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"ssrf","year":"2025"},"n_packages":3,"n_references":2,"next":{"headline":"Missing Maximum Password Length Validation in Strapi Password Hashing","id":"CVE-2025-25298"},"packages":[{"ecosystem":"PyPI","fixed":["1.16.0"],"introduced":["0"],"last_affected":[],"package":"label-studio","purl":null,"source":"GHSA-m238-fmcw-wh58"},{"ecosystem":"PyPI","fixed":["1.16.0"],"introduced":["0"],"last_affected":[],"package":"label-studio","purl":"pkg:pypi/label-studio","source":"GHSA-m238-fmcw-wh58"},{"ecosystem":"PyPI","fixed":["1.16.0"],"introduced":["0"],"last_affected":[],"package":"label-studio","purl":"pkg:pypi/label-studio","source":"PYSEC-2026-1503"}],"prev":{"headline":"Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint","id":"CVE-2025-25296"},"products":["label-studio"],"published":"2025-02-14","related":[{"cvss_score":9.8,"headline":"Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens","id":"CVE-2023-43791","kev_date_added":null,"published":"2023-11-09"},{"cvss_score":8.6,"headline":"Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field","id":"CVE-2026-22033","kev_date_added":null,"published":"2026-01-12"},{"cvss_score":7.6,"headline":"label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.","id":"CVE-2025-47783","kev_date_added":null,"published":"2025-05-14"},{"cvss_score":7.5,"headline":"Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio","id":"CVE-2023-47117","kev_date_added":null,"published":"2023-11-13"},{"cvss_score":7.1,"headline":"Label Studio XSS Vulnerability on Avatar Upload","id":"CVE-2023-47115","kev_date_added":null,"published":"2024-01-23"},{"cvss_score":6.1,"headline":"Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint","id":"CVE-2025-25296","kev_date_added":null,"published":"2025-02-14"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-02-14","vendors":["HumanSignal"]},"summary":"Attackers can exploit an SSRF vulnerability in the S3 storage configuration to access internal services and exfiltrate data via error messages.","url":"https://insights.sbomify.com/CVE-2025-25297/"}