{"action":"Upgrade rembg to 2.0.75 or later.","affected":[{"fixed":"2.0.75","introduced":"0"}],"component":"rembg","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["2.0.75"],"ghsa_id":"GHSA-55v6-g8pm-pw4c","id":"tcs_01M5KF02T2QD52RTCTM72JB4PD","modified_at":"2026-04-10T22:17:48.332110Z","published_at":"2026-04-10T22:09:15Z","references":["https://osv.dev/vulnerability/GHSA-55v6-g8pm-pw4c","https://github.com/danielgatis/rembg/security/advisories/GHSA-55v6-g8pm-pw4c","https://github.com/danielgatis/rembg/commit/07ad0d493057bddf821dcc3e2410eb7e065257c0","https://github.com/danielgatis/rembg","https://github.com/danielgatis/rembg/releases/tag/v2.0.75"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-55v6-g8pm-pw4c","url":"https://osv.dev/vulnerability/GHSA-55v6-g8pm-pw4c"}],"summary":"rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak default CORS configuration"}