{"cve":"CVE-2025-25302","nvd":{"published":"2025-03-03T17:15:14.920","modified":"2026-06-17T09:00:38.900","status":"Analyzed","description":"Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5},"cwes":["CWE-346"],"references":["https://github.com/danielgatis/rembg/blob/d1e00734f8a996abf512a3a5c251c7a9a392c90a/rembg/commands/s_command.py#L93","https://securitylab.github.com/advisories/GHSL-2024-161_GHSL-2024-162_rembg/"],"products":["danielgatis:rembg"],"source":"nvd","synced_at":"2026-10-19T21:59:48.811064707+00:00"},"epss":{"cve":"CVE-2025-25302","score":0.00195,"percentile":0.09227,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-59qh-fmm7-3g9q","url":"https://osv.dev/vulnerability/GHSA-59qh-fmm7-3g9q","summary":"Rembg CORS misconfiguration","modified":"2025-04-09T17:59:22.986651Z","packages":[{"ecosystem":"PyPI","name":"rembg","purl":"pkg:pypi/rembg","ranges":["<=2.0.57"],"fixed":[]}]},{"id":"PYSEC-2025-25","url":"https://osv.dev/vulnerability/PYSEC-2025-25","summary":"","modified":"2026-06-10T17:02:35.978741681Z","packages":[{"ecosystem":"PyPI","name":"rembg","purl":"pkg:pypi/rembg","ranges":["<2.0.58"],"fixed":["2.0.58"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}