CVE-2025-25302

Name of the Vulnerable Software and Affected Versions Rembg versions 2.0.57 and earlier

Description The issue concerns the CORS middleware setup in Rembg, which is configured to reflect all origins. This allows any website to send cross-site requests to the Rembg server, enabling them to query any API. Furthermore, even if authentication is enabled, the allow credentials setting is set to True, which would permit any website to send authenticated cross-site requests.

Recommendations For Rembg versions 2.0.57 and earlier, update the CORS middleware configuration to only reflect trusted origins and set allow credentials to False to prevent unauthorized cross-site requests.