What is GHSA-59qh-fmm7-3g9q?

GHSA-59qh-fmm7-3g9q is a security advisory published by GitHub Security Advisories with High severity. Rembg CORS misconfiguration

Which CVE IDs does GHSA-59qh-fmm7-3g9q cover?

GHSA-59qh-fmm7-3g9q covers the following CVE IDs: CVE-2025-25302. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-59qh-fmm7-3g9q?

GHSA-59qh-fmm7-3g9q affects 1 product, including: pip/rembg:\u003c= 2.0.57.

GHSA-59qh-fmm7-3g9qHigh

Rembg CORS misconfiguration

Vendor

GitHub Security Advisories

Published

March 11, 2025

Last Modified

March 11, 2025

🔗 CVE IDs covered (1)

CVE-2025-25302 →

📋 Description

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.

🎯 Affected products1

pip/rembg:<= 2.0.57

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-25302
https://github.com/danielgatis/rembg/blob/d1e00734f8a996abf512a3a5c251c7a9a392c90a/rembg/commands/s_command.py#L93
https://securitylab.github.com/advisories/GHSL-2024-161_GHSL-2024-162_rembg
https://github.com/advisories/GHSA-59qh-fmm7-3g9q