CVE-2023-47117

HighPublished

Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio

Published: Nov 13, 2023
Updated: Jan 8, 2025
Assigning CNA: GitHub_M
Evidence observed: Aug 28, 2026

Primary CVSS

7.5/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS probability estimate

4.1%

Low · next 30 days

Percentile: 90.6%
Model date: Oct 29, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by character. In addition, Label Studio had a hard coded secret key that an attacker can use to forge a session token of any user by exploiting this ORM Leak vulnerability to leak account password hashes. This vulnerability has been addressed in commit `f931d9d129` which is included in the 1.9.2post0 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

Label Studio - Sensitive Information ExposureTemplate
http/cves/2023/CVE-2023-47117.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 5cfe87d58464Related tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)

publicationsResearch

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.