5 results · Feed
-
High 8.6
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model through rembg/commands/s_command.py to rembg/sessions/sam.py, where it is interpolated into SAM filenames and GitHub down…
-
Medium 4.3
rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak default CORS configuration
# GitHub Security Lab (GHSL) Vulnerability Report, rembg: `GHSL-2024-161`, `GHSL-2024-162` The [GitHub Security Lab](https://securitylab.github.com) team has identified potential security vulnerabilities in [rembg](https://github.com/danielgatis/rembg). We ar…
-
Medium 5.3
Rembg has a Path Traversal via Custom Model Loading
Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious m…
-
High 8.7
Rembg CORS misconfiguration
Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authenticat…
-
Medium 6.9
Rembg allows SSRF via /api/remove
Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted o…