1.23.1 1.23.2
HumanSignal/label-studioSep 25, 2026 → Sep 29, 20264 days between releases
What's New
Tightens SECRET_KEY permissions and blocks private network media in image exports
Breaking Changes
- Existing SECRET_KEY files readable by others must be rotated
- Image exports may exclude media hosted on internal servers if SSRF protection is enabled
- Existing access tokens stop working after SECRET_KEY rotation
- Everyone must log in again after rotating the SECRET_KEY
New Features
- Sandboxing for uploaded HTML, SVG, and XML files via Content-Security-Policy
- Improved security for S3-compatible storage endpoints regarding DNS rebinding
- Enhanced image export logic to block private network media URLs
Improvements
- Generated SECRET_KEY file permissions are now restricted to the owner only
Upgrade Notes
Rotate your SECRET_KEY if other users can read the data directory to prevent unauthorized access. Image exports now skip media from private networks by default, requiring configuration adjustments if internal media is used. Ensure LABEL_STUDIO_HOST is set to allow exports to include uploaded files from the local server.
The Two Releases
1.23.1
Sep 25, 2026· 27 days ago
This security-focused patch release introduces stricter protections for ML backends and webhooks while requiring PostgreSQL 14 or higher. It also enforces new secure default configurations for network access and error handling.
Full release notes1.23.2
Sep 29, 2026· 23 days ago
A security and stability update that tightens file permissions, improves image export handling for private networks, and adds sandboxing for uploaded HTML, SVG, and XML files.
Full release notes