CVE-2026-22033 Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field
Authenticated attackers can inject JavaScript via custom hotkeys to steal API tokens and take over user accounts in Label Studio.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22033?
CVE-2026-22033 is a high-severity cross-site scripting vulnerability in HumanSignal label-studio, published on 12 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Label Studio is a multi-type data labeling and annotation tool. In 1.22.0 and earlier, a persistent stored cross-site scripting (XSS) vulnerability exists in the custom_hotkeys functionality of the application. An authenticated attacker (or one who can trick a user/administrator into updating their custom_hotkeys) can inject JavaScript code that executes in other users’ browsers when those users load any page using the templates/base.html template. Because the application exposes an API token endpoint (/api/current-user/token) to the browser and lacks robust CSRF protection on some API endpoints, the injected script may fetch the victim’s API token or call token reset endpoints — enabling full account takeover and unauthorized API access.
Which versions are affected by CVE-2026-22033?
3 open source packages ship an affected version, including label-studio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
label-studio PyPI | All versions to 1.22.0 | None |
label-studio PyPI | All versions to 1.22.0 | None |
label-studio PyPI | All versions to 1.22.0 | None |
Products include Humansignal Label Studio.
How do I fix CVE-2026-22033?
No fix has been published for CVE-2026-22033 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-22033 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22033 exists.
Other vulnerabilities in HumanSignal label-studio
- CVE-2023-43791 Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens
- CVE-2025-25297 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint
- CVE-2025-47783 label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.
- CVE-2023-47117 Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio
- CVE-2023-47115 Label Studio XSS Vulnerability on Avatar Upload
Sources
Also known as GHSA-2mq9-hm29-8qch, PYSEC-2026-1502.