Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

rembg

4 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
2.0.87 (Nov 6, 2026): no advisory affects it
Newest unaffected release
2.0.87 (Nov 6, 2026), the latest release
Advisories
4 · 2 high, 2 medium
Weekly downloads
1M
Dependents
97
Releases
59 since 2.0.28 (Nov 24, 2022)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs

    Affected: fixed in 2.0.82.

    Fixed in 2.0.82 (released Sep 2, 2026, 54 days before disclosure).

    The latest release, 2.0.87, is not affected.

  • CVE-2026-40086Medium 5.3

    Rembg has a Path Traversal via Custom Model Loading

    Affected: fixed in 2.0.75.

    Fixed in 2.0.75 (released Apr 8, 2026, 2 days before disclosure).

    The latest release, 2.0.87, is not affected.

  • Rembg CORS misconfiguration

    Affected: fixed in 2.0.58; through 2.0.57.

    Fixed in 2.0.58 (released Aug 4, 2024, 211 days before disclosure).

    The latest release, 2.0.87, is not affected.

  • CVE-2025-25301Medium 6.9

    Rembg allows SSRF via /api/remove

    Affected: through 2.0.57; fixed in 2.0.58.

    Fixed in 2.0.58 (released Aug 4, 2024, 211 days before disclosure).

    The latest release, 2.0.87, is not affected.