PT-2025-9520 · Rembg · Rembg

Kevin Stubbings + 1 · Published 2025-03-03 · Updated 2025-03-21 · CVE-2025-25302

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Rembg versions 2.0.57 and earlier

Description The issue concerns the CORS middleware setup in Rembg, which is configured to reflect all origins. This allows any website to send cross-site requests to the Rembg server, enabling them to query any API. Furthermore, even if authentication is enabled, the allow credentials setting is set to True, which would permit any website to send authenticated cross-site requests.

Recommendations For Rembg versions 2.0.57 and earlier, update the CORS middleware configuration to only reflect trusted origins and set allow credentials to False to prevent unauthorized cross-site requests.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2025-25302

GHSA-59QH-FMM7-3G9Q

PYSEC-2025-25

Affected Products

Rembg

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25302.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-161_GHSL-2024-162_rembg · Exploit
• https://osv.dev/vulnerability/CVE-2025-25302 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-59qh-fmm7-3g9q · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-25 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25302 · Security Note
• https://github.com/danielgatis/rembg · Note
• https://github.com/danielgatis/rembg/blob/d1e00734f8a996abf512a3a5c251c7a9a392c90a/rembg/commands/s_command.py#L93 · Note
• https://twitter.com/dailycve/status/1903086919778492441 · Twitter Post
• https://t.me/cvenotify/115637 · Telegram Post
• https://twitter.com/CVEnew/status/1896767600303952238 · Twitter Post
• https://t.me/cvedetector/19380 · Telegram Post