rembg CORS misconfiguration (CVE-2025-25302)
The rembg image processing server contains a CORS misconfiguration that allows any website to send requests to the application, potentially enabling cross-site attacks and amplifying other vulnerabilities.
What happened
The rembg server version 2.0.57 contains a CORS middleware configuration that allows all origins (allow_origins = ["*"]), all methods, and all headers, with allow_credentials set to True.
This misconfiguration allows any website to send cross-site requests to the rembg server and query its API endpoints, including with authenticated credentials if enabled.
Reported impact
The CORS misconfiguration may increase the severity of other vulnerabilities in the application by enabling cross-site attacks.
Index analysis
The vulnerability was reported to the maintainer on 2024-07-17 via GitHub's Private Vulnerability Reporting.
Governance controls
The maintainer responded on 2024-10-29 indicating intention to fix the issues in the future.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.