PYSEC-2025-24

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/rembg/PYSEC-2025-24.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2025-24
Aliases
Published
2025-03-03T17:15:14Z
Modified
2025-04-09T17:59:20.454660Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg server. This issue may lead to Information Disclosure.

References

Affected packages

PyPI / rembg

Package

Name
rembg
View open source insights on deps.dev
Purl
pkg:pypi/rembg

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.58

Affected versions

2.*

2.0.28
2.0.29
2.0.30
2.0.31
2.0.32
2.0.33
2.0.34
2.0.35
2.0.36
2.0.37
2.0.38
2.0.39
2.0.40
2.0.41
2.0.43
2.0.44
2.0.45
2.0.46
2.0.47
2.0.48
2.0.49
2.0.50
2.0.51
2.0.52
2.0.53
2.0.54
2.0.55
2.0.56
2.0.57