Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/rembg@2.0.38
Typepypi
Namespace
Namerembg
Version2.0.38
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.0.58
Latest_non_vulnerable_version2.0.58
Affected_by_vulnerabilities
0
url VCID-5491-113y-w7dm
vulnerability_id VCID-5491-113y-w7dm
summary Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg server. This issue may lead to Information Disclosure.
references
0
reference_url https://securitylab.github.com/advisories/GHSL-2024-161_GHSL-2024-162_rembg/
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://securitylab.github.com/advisories/GHSL-2024-161_GHSL-2024-162_rembg/
fixed_packages
0
url pkg:pypi/rembg@2.0.58
purl pkg:pypi/rembg@2.0.58
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/rembg@2.0.58
aliases CVE-2025-25301, PYSEC-2025-24
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5491-113y-w7dm
1
url VCID-j4jv-uxp8-gqft
vulnerability_id VCID-j4jv-uxp8-gqft
summary Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.
references
0
reference_url https://github.com/danielgatis/rembg/blob/d1e00734f8a996abf512a3a5c251c7a9a392c90a/rembg/commands/s_command.py#L93
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://github.com/danielgatis/rembg/blob/d1e00734f8a996abf512a3a5c251c7a9a392c90a/rembg/commands/s_command.py#L93
1
reference_url https://securitylab.github.com/advisories/GHSL-2024-161_GHSL-2024-162_rembg/
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://securitylab.github.com/advisories/GHSL-2024-161_GHSL-2024-162_rembg/
fixed_packages
0
url pkg:pypi/rembg@2.0.58
purl pkg:pypi/rembg@2.0.58
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/rembg@2.0.58
aliases CVE-2025-25302, PYSEC-2025-25
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-j4jv-uxp8-gqft
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/rembg@2.0.38