{"data":{"id":"cef70d1b-2dc4-4cc0-81a5-9ecd0c8aa1c7","title":"CVE-2026-115924: Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes…","summary":"Rembg versions before 2.0.82 expose the public /api/remove endpoint, which passes the attacker-controlled extras.sam_model value into SAM filenames and GitHub download URLs fetched by pooch.retrieve() without a pinned hash. An unauthenticated attacker can use path traversal combined with URL fragment syntax to make attacker-chosen ONNX encoder and decoder files download beside a target file, which the graphs can read via ONNX external data and encode into the returned PNG mask, disclosing complete files readable by the rembg process and enabling arbitrary ONNX computation.","solution":"This issue is fixed in version 2.0.82.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115924","publishedAt":"2026-10-26T20:17:52.250Z","cveId":"CVE-2026-115924","cweIds":["CWE-22"],"cvssScore":"8.6","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["rembg"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Rembg unauthenticated file disclosure through public /api/remove endpoint","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-27T06:10:23.124Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-27T06:10:27.581Z","patchAvailable":null,"disclosureDate":"2026-10-26T20:17:52.250Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}