diff --git a/advisories/github-reviewed/2023/07/GHSA-ppxx-m926-g569/GHSA-ppxx-m926-g569.json b/advisories/github-reviewed/2023/07/GHSA-ppxx-m926-g569/GHSA-ppxx-m926-g569.json index 4b6bdc1626f..5f645c2dcc9 100644 --- a/advisories/github-reviewed/2023/07/GHSA-ppxx-m926-g569/GHSA-ppxx-m926-g569.json +++ b/advisories/github-reviewed/2023/07/GHSA-ppxx-m926-g569/GHSA-ppxx-m926-g569.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-ppxx-m926-g569", - "modified": "2023-08-08T21:28:39Z", + "modified": "2025-05-16T22:12:11Z", "published": "2023-07-06T19:24:01Z", "aliases": [ "CVE-2022-24697" @@ -97,7 +97,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-77" + "CWE-77", + "CWE-78" ], "severity": "CRITICAL", "github_reviewed": true, diff --git a/advisories/github-reviewed/2024/02/GHSA-6xv9-957j-qfhg/GHSA-6xv9-957j-qfhg.json b/advisories/github-reviewed/2024/02/GHSA-6xv9-957j-qfhg/GHSA-6xv9-957j-qfhg.json index b09f55b0c66..913eedc1150 100644 --- a/advisories/github-reviewed/2024/02/GHSA-6xv9-957j-qfhg/GHSA-6xv9-957j-qfhg.json +++ b/advisories/github-reviewed/2024/02/GHSA-6xv9-957j-qfhg/GHSA-6xv9-957j-qfhg.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-6xv9-957j-qfhg", - "modified": "2024-02-23T00:31:30Z", + "modified": "2025-05-16T22:12:36Z", "published": "2024-02-22T21:52:57Z", "aliases": [ "CVE-2024-26152" ], "summary": "Label Studio vulnerable to Cross-site Scripting if `` or `` are used in labeling config ", - "details": "### Summary\nOn all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Choices`](https://labelstud.io/tags/choices) or [`Labels`](https://labelstud.io/tags/labels) tag, resulting in an XSS vulnerability.\n\n### Details\nNeed permission to use the \"data import\" function. This was reproduced on Label Studio 1.10.1.\n\n### PoC\n\n1. Create a project.\n![Create a project](https://github.com/HumanSignal/label-studio/assets/3943358/9b1536ad-feac-4238-a1bd-ca9b1b798673)\n\n2. Upload a file containing the payload using the \"Upload Files\" function.\n![2 Upload a file containing the payload using the Upload Files function](https://github.com/HumanSignal/label-studio/assets/3943358/26bb7af1-1cd2-408f-9adf-61e31a5b7328)\n![3 complete](https://github.com/HumanSignal/label-studio/assets/3943358/f2f62774-1fa6-4456-9e6f-8fa1ca0a2d2e)\n\nThe following are the contents of the files used in the PoC\n```\n{\n \"data\": {\n \"prompt\": \"labelstudio universe image\",\n \"images\": [\n {\n \"value\": \"id123#0\",\n \"style\": \"margin: 5px\",\n \"html\": \"\"\n }\n ]\n }\n}\n```\n\n3. Select the text-to-image generation labeling template of Ranking and scoring\n![3 Select the text-to-image generation labelling template for Ranking and scoring](https://github.com/HumanSignal/label-studio/assets/3943358/f227f49c-a718-4738-bc2a-807da4f97155)\n![5 save](https://github.com/HumanSignal/label-studio/assets/3943358/9b529f8a-8e99-4bb0-bdf6-bb7a95c9b75d)\n\n4. Select a task\n![4 Select a task](https://github.com/HumanSignal/label-studio/assets/3943358/71856b7a-2b1f-44ea-99ab-fc48bc20caa7)\n\n5. Check that the script is running\n![5 Check that the script is running](https://github.com/HumanSignal/label-studio/assets/3943358/e396ae7b-a591-4db7-afe9-5bab30b48cb9)\n\n### Impact\nMalicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.\n", + "details": "### Summary\nOn all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Choices`](https://labelstud.io/tags/choices) or [`Labels`](https://labelstud.io/tags/labels) tag, resulting in an XSS vulnerability.\n\n### Details\nNeed permission to use the \"data import\" function. This was reproduced on Label Studio 1.10.1.\n\n### PoC\n\n1. Create a project.\n![Create a project](https://github.com/HumanSignal/label-studio/assets/3943358/9b1536ad-feac-4238-a1bd-ca9b1b798673)\n\n2. Upload a file containing the payload using the \"Upload Files\" function.\n![2 Upload a file containing the payload using the Upload Files function](https://github.com/HumanSignal/label-studio/assets/3943358/26bb7af1-1cd2-408f-9adf-61e31a5b7328)\n![3 complete](https://github.com/HumanSignal/label-studio/assets/3943358/f2f62774-1fa6-4456-9e6f-8fa1ca0a2d2e)\n\nThe following are the contents of the files used in the PoC\n```\n{\n \"data\": {\n \"prompt\": \"labelstudio universe image\",\n \"images\": [\n {\n \"value\": \"id123#0\",\n \"style\": \"margin: 5px\",\n \"html\": \"\"\n }\n ]\n }\n}\n```\n\n3. Select the text-to-image generation labeling template of Ranking and scoring\n![3 Select the text-to-image generation labelling template for Ranking and scoring](https://github.com/HumanSignal/label-studio/assets/3943358/f227f49c-a718-4738-bc2a-807da4f97155)\n![5 save](https://github.com/HumanSignal/label-studio/assets/3943358/9b529f8a-8e99-4bb0-bdf6-bb7a95c9b75d)\n\n4. Select a task\n![4 Select a task](https://github.com/HumanSignal/label-studio/assets/3943358/71856b7a-2b1f-44ea-99ab-fc48bc20caa7)\n\n5. Check that the script is running\n![5 Check that the script is running](https://github.com/HumanSignal/label-studio/assets/3943358/e396ae7b-a591-4db7-afe9-5bab30b48cb9)\n\n### Impact\nMalicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.", "severity": [ { "type": "CVSS_V3",