PyPI/rembg CVE-2026-40086: medium 5.3, EPSS 0.59%

Rembg has a Path Traversal via Custom Model Loading

Action: Upgrade rembg to 2.0.75 or later.

pip install rembg==2.0.75

Affected

Fixed versions

Sources

• osv: GHSA-3wqj-33cg-xc48
• https://github.com/danielgatis/rembg/security/advisories/GHSA-3wqj-33cg-xc48
• https://nvd.nist.gov/vuln/detail/CVE-2026-40086
• https://github.com/danielgatis/rembg/commit/7c76d3cdc5757ffbda6a76664b24cfbecdb80273
• https://github.com/danielgatis/rembg
• https://github.com/danielgatis/rembg/releases/tag/v2.0.75

CVE-2026-40086 · published 2026-04-10T20:00:12Z · modified 2026-07-13T07:26:21.502912985Z · JSON