Vulnerabilities for rembg

First version without a known vulnerability: 2.0.75

Details

• GHSA-55v6-g8pm-pw4c2026-04-10

  rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak default CORS configuration

  Fixed in: 2.0.75

• GHSA-3wqj-33cg-xc482026-04-10

  Rembg has a Path Traversal via Custom Model Loading

  Fixed in: 2.0.75

• GHSA-59qh-fmm7-3g9q2025-03-11

  Rembg CORS misconfiguration

  Fixed in: 2.0.58

• GHSA-r5gx-c49x-h8782025-03-11

  Rembg allows SSRF via /api/remove

  Fixed in: 2.0.58