CVE-2023-47117: Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task
Summary
CVE-2023-47117: Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task. Affects label-studio versions < 1.9.2.post0. Fixed in 1.9.2.post0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Label Studio is an open source data labeling tool that allows users to annotate data for machine learning projects. It provides a user-friendly interface for creating labeling tasks and managing annotations. The tool is widely used in various industries for tasks such as image classification, text annotation, and object detection. However, a vulnerability has been discovered in Label Studio that allows an attacker to leak sensitive information, such as password hashes, by exploiting the Object Relational Mapper (ORM) in the filtering task functionality.
Vulnerability Detail
The vulnerability in Label Studio arises from the insecure handling of filters in the filtering task feature. The application allows users to set filters for tasks, but these filters are not properly validated and can be manipulated to leak sensitive information. By constructing a filter chain that targets sensitive fields, an attacker can gradually leak the information character by character. In this case, the vulnerability allows an attacker to leak the password hash of an account on Label Studio. Additionally, the presence of a hard-coded secret key in the application can be exploited to forge session tokens of any user.
How To Fix
Latest published version: 1.23.2 as of 23 Oct 2026
pip install --upgrade "label-studio==1.23.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.2.post0
This is the first release that contains the fix.
pip install --upgrade "label-studio==1.9.2.post0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of Label Studio as soon as possible.
Conclusion
The vulnerability in Label Studio allows an attacker to leak sensitive information and potentially compromise the integrity and availability of the application. It is crucial for users of Label Studio to update to the latest version (1.9.2post0 or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for label-studio →
FAQ
Label Studio is an open source data labeling tool used for annotating data for machine learning projects.
This vulnerability allows an attacker to leak sensitive information, such as password hashes, and potentially forge session tokens of any user on Label Studio.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your version of Label Studio is affected by this vulnerability.
Yes, the developers of Label Studio have released a fix in version 1.9.2post0. It is recommended to update to this version or later.
There are no known workarounds for this vulnerability. It is recommended to update to the latest version of Label Studio.
References
Related vulnerabilities
Recent vulnerabilities recorded for label-studio.
