GHSA-59qh-fmm7-3g9q

Rembg CORS misconfiguration

Source: GitHub Advisory Database (reviewed) High CVE-2025-25302

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	rembg	<= 2.0.57	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-25302 advisory
https://github.com/danielgatis/rembg package
https://github.com/danielgatis/rembg/blob/d1e00734f8a996abf512a3a5c251c7a9a392c90a/rembg/commands/s_command.py#L93 web
https://securitylab.github.com/advisories/GHSL-2024-161_GHSL-2024-162_rembg advisory