Cross-Site Request Forgery Vulnerability in Rembg Tool

CVE-2025-25302

What is CVE-2025-25302?

The Rembg tool, used for image background removal, is affected by a critical misconfiguration in its Cross-Origin Resource Sharing (CORS) middleware. This flaw allows all origins to be reflected, enabling any website to issue cross-site requests to the Rembg server. As a result, malicious websites can potentially query APIs directly. Compounding the issue, even if authentication measures are applied, the 'allow_credentials' setting is configured to True, thereby permitting unauthorized sites to send authenticated requests. Ensuring correct CORS configuration is essential to safeguard against these vulnerabilities.

References