Vulnerability · Published Mar 3, 2025 · Assigned by GitHub_M
CVE-2025-25302Rembg CORS misconfiguration
High 8.7
In plain English
A high-severity security flaw in rembg from danielgatis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | rembg | no fix listed | GHSA-59qh-fmm7-3g9q |
| PyPI | rembg | 2.0.58 | PYSEC-2025-25 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| danielgatis | rembg | <= 2.0.57 |
Weakness: CWE-346 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N