Threats tagged 'ghsa-m949-r65c-x2m9'

Label Studio versions before 1.23.2 and label-studio-sdk before 2.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows authenticated users to read internal URLs by exploiting image-bearing export formats. Attackers can import tasks with images pointing to internal services, export them in formats like YOLO or COCO to read responses, and spoof the Host header to capture the organization owner's API token.