CVE-2025-25302 Rembg CORS misconfiguration
Rembg's CORS misconfiguration allows any website to send cross-site requests, potentially exposing API data or bypassing authentication controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-25302?
CVE-2025-25302 is a high-severity vulnerability in danielgatis rembg, published on 3 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.
Weakness: CWE-346
Which versions are affected by CVE-2025-25302?
3 open source packages ship an affected version, including rembg. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rembg PyPI | All versions to 2.0.57 | None |
rembg PyPI | All versions to 2.0.57 | None |
rembg PyPI | All versions | 2.0.58 |
Products include Danielgatis Rembg.
How do I fix CVE-2025-25302?
Upgrade rembg to 2.0.58 or later.
Is CVE-2025-25302 being exploited?
There is no known exploitation of CVE-2025-25302 in the wild and no public exploit code.
Other vulnerabilities in danielgatis rembg
Sources
Also known as GHSA-59qh-fmm7-3g9q, PYSEC-2025-25.