CVE-2025-25296: Label Studio XSS Vulnerability

CVE-2025-25296 Overview

CVE-2025-25296 is a reflected Cross-Site Scripting (XSS) vulnerability in Label Studio, an open source data labeling platform maintained by HumanSignal. The flaw affects versions prior to 1.16.0 and resides in the /projects/upload-example endpoint. The endpoint accepts a label_config query parameter over GET and renders user-controlled XML with inline task data as HTML without sanitization. An attacker crafts a malicious URL containing a specially formatted XML label config with embedded JavaScript, then lures an authenticated user to visit it. The application ships a Content Security Policy (CSP) in report-only mode, which logs violations but does not block script execution.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions within Label Studio projects.

Affected Products

HumanSignal Label Studio versions prior to 1.16.0
Deployments exposing the /projects/upload-example endpoint over the network
Any Label Studio instance relying on the report-only CSP as a defense

Discovery Timeline

2025-02-14 - CVE-2025-25296 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25296

Vulnerability Analysis

The vulnerability is a reflected XSS classified under [CWE-79]. The upload_example_using_config view in label_studio/projects/views.py handled both GET and POST methods and pulled the label_config parameter directly from the query string. Label Studio then parsed the supplied XML and rendered inline task data as part of an HTML response.

Because the response reflected attacker-controlled markup without output encoding, embedded <script> tags and event handlers executed in the browser. The CSP header was delivered as Content-Security-Policy-Report-Only, so the browser reported violations but still ran injected scripts. Exploitation requires user interaction, but no authentication or privileges on the attacker's side.

Root Cause

The root cause is missing output sanitization on a state-changing accessor exposed to GET. The endpoint trusted the label_config query parameter as safe template input and constructed inline task previews containing raw HTML. A misconfigured CSP compounded the issue by advertising a policy that was never enforced.

Attack Vector

An attacker builds a URL such as https://<label-studio-host>/projects/upload-example?label_config=<malicious XML> where the XML contains inline task data with HTML and JavaScript payloads. The attacker delivers the link through phishing, chat, or an embedded iframe. When a logged-in Label Studio user opens the link, the injected script runs with the victim's session cookies and can call authenticated API endpoints, exfiltrate project data, or pivot to account takeover.

python

     return task_data
 
 
-@require_http_methods(['GET', 'POST'])
+@require_http_methods(['POST'])
 def upload_example_using_config(request):
     """Generate upload data example by config only"""
-    config = request.GET.get('label_config', '')
-    if not config:
-        config = request.POST.get('label_config', '')
+    config = request.POST.get('label_config', '')
 
     org_pk = get_organization_from_request(request)
     secure_mode = False

Source: HumanSignal label-studio commit 8cf6958. The patch removes GET support from upload_example_using_config, forcing the label_config parameter to arrive via POST body and eliminating the URL-based reflected XSS primitive.

Detection Methods for CVE-2025-25296

Indicators of Compromise

HTTP GET requests to /projects/upload-example containing a label_config query parameter with <script>, onerror=, javascript:, or encoded variants.
Web server access logs showing unusually long label_config values with URL-encoded XML tags such as %3CView%3E combined with HTML sinks.
CSP report endpoints receiving violation reports referencing inline scripts on the /projects/upload-example path.
Outbound requests from user browsers to attacker-controlled hosts immediately after visiting a Label Studio URL.

Detection Strategies

Deploy a WAF or reverse proxy rule that inspects the label_config query parameter for HTML tags and blocks matching GET requests.
Alert on any GET traffic to /projects/upload-example after upgrading, since the patched build only accepts POST.
Correlate referer headers pointing to external domains with requests to Label Studio's project endpoints to surface phishing-driven access.

Monitoring Recommendations

Enable Content-Security-Policy in enforcing mode and forward violation reports to a SIEM for triage.
Log and retain full request URIs for the Label Studio application tier to enable retrospective hunting.
Monitor Label Studio session activity for anomalous API calls following the load of upload-example responses.

How to Mitigate CVE-2025-25296

Immediate Actions Required

Upgrade Label Studio to version 1.16.0 or later, which restricts upload_example_using_config to POST only.
Audit web server and reverse proxy logs for prior GET requests to /projects/upload-example carrying suspicious label_config values.
Rotate active user sessions and API tokens if exploitation indicators are found.

Patch Information

HumanSignal released the fix in commit 8cf6958e1e27ef6a03ed287e674470975d340885, published as part of Label Studio 1.16.0. Refer to the GitHub Security Advisory GHSA-wpq5-3366-mqw4 and the upstream commit for full details. A public proof of concept is available at the CVE-2025-25296 POC repository.

Workarounds

Block GET requests to /projects/upload-example at the reverse proxy or ingress layer until the upgrade is deployed.
Switch the application CSP from Content-Security-Policy-Report-Only to Content-Security-Policy with a strict script-src directive to prevent inline execution.
Restrict network exposure of Label Studio to authenticated VPN or SSO-protected paths to reduce phishing reach.

bash

# Nginx configuration example: block vulnerable GET path pre-upgrade
location = /projects/upload-example {
    if ($request_method = GET) {
        return 403;
    }
    proxy_pass http://label_studio_backend;
}

# Enforce CSP instead of report-only
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;