EUVD-2025-6006

Malicious code in bioql PyPI...

Origin Validation Error

Rembg is vulnerable to Origin Validation Error. The vulnerability is due to improper CORS middleware configuration, which reflects all origins and sets allowcredentials to True, allowing any website to send authenticated cross-site requests to the Rembg server...

Server Side Request Forgery (SSRF)

Rembg is vulnerable to Server Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied URLs, allowing an attacker to request internal network resources via the /api/remove endpoint...

adversarial-attacks-white-black-box (=0.1.7) potentially affected by CVE-2025-25302 via rembg (=2.0.57)

rembg PYPI version =2.0.57 is affected by a known vulnerability. The following packages have a transitive dependency on rembg and may be impacted: - adversarial-attacks-white-black-box =0.1.7 Source cves: CVE-2025-25302 Source advisory: OSV:GHSA-59QH-FMM7-3G9Q...

GHSA-59QH-FMM7-3G9Q Rembg CORS misconfiguration

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

Rembg CORS misconfiguration

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

adversarial-attacks-white-black-box (=0.1.7) potentially affected by CVE-2025-25301 via rembg (=2.0.57)

rembg PYPI version =2.0.57 is affected by a known vulnerability. The following packages have a transitive dependency on rembg and may be impacted: - adversarial-attacks-white-black-box =0.1.7 Source cves: CVE-2025-25301 Source advisory: OSV:GHSA-R5GX-C49X-H878...

GHSA-R5GX-C49X-H878 Rembg allows SSRF via /api/remove

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg...

Rembg allows SSRF via /api/remove

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg...

CVE-2025-25301

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg...

CVE-2025-25302

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

Origin Validation Error

Overview rembg is a Remove image background Affected versions of this package are vulnerable to Origin Validation Error in the addmiddleware function in scommand.py, which reflects all origins by default. Due to the allowcredentials=True setting, an attacker can send authenticated cross-site...

PYSEC-2025-24

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg...

adversarial-attacks-white-black-box (=0.1.7) potentially affected by CVE-2025-25301 via rembg (=2.0.57)

rembg PYPI version =2.0.57 is affected by a known vulnerability. The following packages have a transitive dependency on rembg and may be impacted: - adversarial-attacks-white-black-box =0.1.7 Source cves: CVE-2025-25301 Source advisory: OSV:PYSEC-2025-24...

PYSEC-2025-25

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

adversarial-attacks-white-black-box (=0.1.7) potentially affected by CVE-2025-25302 via rembg (=2.0.57)

rembg PYPI version =2.0.57 is affected by a known vulnerability. The following packages have a transitive dependency on rembg and may be impacted: - adversarial-attacks-white-black-box =0.1.7 Source cves: CVE-2025-25302 Source advisory: OSV:PYSEC-2025-25...

PYSEC-2025-24

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg...

CVE-2025-25302

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

CVE-2025-25301

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg...

PYSEC-2025-25

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...