Search criteria

2 vulnerabilities found for label-studio-ml-backend by HumanSignal

CVE-2025-5173 (GCVE-0-2025-5173)

Vulnerability from nvd – Published: 2025-05-26 06:31 – Updated: 2025-05-28 17:36
VLAI?
Title
HumanSignal label-studio-ml-backend PT File neural_nets.py load deserialization
Summary
A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py of the component PT File Handler. The manipulation of the argument path leads to deserialization. An attack has to be approached locally. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
Severity ?
4.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
5.3 (Medium)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE
Assigner
References
https://vuldb.com/?id.310261 vdb-entrytechnical-description
https://vuldb.com/?ctiid.310261 signaturepermissions-required
https://vuldb.com/?submit.578126 third-party-advisory
https://github.com/HumanSignal/label-studio-ml-ba… issue-tracking
Impacted products
Vendor Product Version
HumanSignal label-studio-ml-backend Affected: 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf
Create a notification for this product.
Credits
ybdesire (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-5173",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-27T17:36:50.889898Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-28T17:36:26.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "PT File Handler"
          ],
          "product": "label-studio-ml-backend",
          "vendor": "HumanSignal",
          "versions": [
            {
              "status": "affected",
              "version": "9fb7f4aa186612806af2becfb621f6ed8d9fdbaf"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "ybdesire (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py of the component PT File Handler. The manipulation of the argument path leads to deserialization. An attack has to be approached locally. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available."
        },
        {
          "lang": "de",
          "value": "In HumanSignal label-studio-ml-backend bis 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf wurde eine Schwachstelle gefunden. Sie wurde als problematisch eingestuft. Das betrifft die Funktion load der Datei label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py der Komponente PT File Handler. Mittels Manipulieren des Arguments path mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Der Angriff muss lokal angegangen werden. Dieses Produkt setzt Rolling Releases ein. Aus diesem Grund sind Details zu betroffenen oder zu aktualisierende Versionen nicht verf\u00fcgbar."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4.3,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "Deserialization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-26T06:31:05.025Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-310261 | HumanSignal label-studio-ml-backend PT File neural_nets.py load deserialization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.310261"
        },
        {
          "name": "VDB-310261 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.310261"
        },
        {
          "name": "Submit #578126 | HumanSignal label-studio-ml-backend 0.0 Deserialization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.578126"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/HumanSignal/label-studio-ml-backend/issues/765"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-05-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-05-25T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-05-25T15:40:32.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "HumanSignal label-studio-ml-backend PT File neural_nets.py load deserialization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-5173",
    "datePublished": "2025-05-26T06:31:05.025Z",
    "dateReserved": "2025-05-25T13:35:14.724Z",
    "dateUpdated": "2025-05-28T17:36:26.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-5173 (GCVE-0-2025-5173)

Vulnerability from cvelistv5 – Published: 2025-05-26 06:31 – Updated: 2025-05-28 17:36
VLAI?
Title
HumanSignal label-studio-ml-backend PT File neural_nets.py load deserialization
Summary
A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py of the component PT File Handler. The manipulation of the argument path leads to deserialization. An attack has to be approached locally. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
Severity ?
4.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
5.3 (Medium)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE
Assigner
References
https://vuldb.com/?id.310261 vdb-entrytechnical-description
https://vuldb.com/?ctiid.310261 signaturepermissions-required
https://vuldb.com/?submit.578126 third-party-advisory
https://github.com/HumanSignal/label-studio-ml-ba… issue-tracking
Impacted products
Vendor Product Version
HumanSignal label-studio-ml-backend Affected: 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf
Create a notification for this product.
Credits
ybdesire (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-5173",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-27T17:36:50.889898Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-28T17:36:26.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "PT File Handler"
          ],
          "product": "label-studio-ml-backend",
          "vendor": "HumanSignal",
          "versions": [
            {
              "status": "affected",
              "version": "9fb7f4aa186612806af2becfb621f6ed8d9fdbaf"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "ybdesire (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in HumanSignal label-studio-ml-backend up to 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf and classified as problematic. Affected by this vulnerability is the function load of the file label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py of the component PT File Handler. The manipulation of the argument path leads to deserialization. An attack has to be approached locally. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available."
        },
        {
          "lang": "de",
          "value": "In HumanSignal label-studio-ml-backend bis 9fb7f4aa186612806af2becfb621f6ed8d9fdbaf wurde eine Schwachstelle gefunden. Sie wurde als problematisch eingestuft. Das betrifft die Funktion load der Datei label-studio-ml-backend/label_studio_ml/examples/yolo/utils/neural_nets.py der Komponente PT File Handler. Mittels Manipulieren des Arguments path mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Der Angriff muss lokal angegangen werden. Dieses Produkt setzt Rolling Releases ein. Aus diesem Grund sind Details zu betroffenen oder zu aktualisierende Versionen nicht verf\u00fcgbar."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4.3,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "Deserialization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-26T06:31:05.025Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-310261 | HumanSignal label-studio-ml-backend PT File neural_nets.py load deserialization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.310261"
        },
        {
          "name": "VDB-310261 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.310261"
        },
        {
          "name": "Submit #578126 | HumanSignal label-studio-ml-backend 0.0 Deserialization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.578126"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/HumanSignal/label-studio-ml-backend/issues/765"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-05-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2025-05-25T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2025-05-25T15:40:32.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "HumanSignal label-studio-ml-backend PT File neural_nets.py load deserialization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2025-5173",
    "datePublished": "2025-05-26T06:31:05.025Z",
    "dateReserved": "2025-05-25T13:35:14.724Z",
    "dateUpdated": "2025-05-28T17:36:26.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}