CVE-2024-23633

CVE-2024-23633 is a cross-site scripting (XSS) vulnerability affecting Label Studio prior to version 1.10.1, an open-source data labeling tool. Attackers could exploit a remote import feature to download a malicious HTML file, executing arbitrary JavaScript in the context of the Label Studio website when viewed by a user. This could lead to actions like creating a Django Super Administrator if an administrator views the crafted content. The vulnerability has a CVSS score of 6.1 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low confidentiality and integrity impacts. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this CVE.