GitHub Advisoryadvisory · PyPI

GHSA-59qh-fmm7-3g9q Rembg CORS misconfiguration

HIGH Published 2025-03-11 Modified 2025-03-11 Official page ↗
Aliases
CVE-2025-25302
Ecosystem
PyPI
Packages
rembg
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-346
Reviewed
2025-03-11

Affected packages

• PyPI rembg: <= 2.0.57 (no fix yet)

Description

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.

Related

Alias · CVE (1)

  • CVE-2025-25302 Rembg is a tool to remove images background. vulnerability

Weakness · CWE (1)

  • CWE-346 Origin Validation Error weakness

References