rembg vulnerabilities
CVEs whose affected-version data names the rembg package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-115924High· 8.6Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
▾ Twilightrembg · rembgEPSS 0.39%via OSV
CVE-2026-40086Medium· 5.3Rembg has a Path Traversal via Custom Model Loading
Rembg has a Path Traversal via Custom Model Loading
▾ Sunlitrembg · rembgEPSS 0.59%via OSV