Rembg is a tool to remove images background.

The public /api/remove endpoint uses attacker-controlled extras.sammodel in both SAM filenames and GitHub download URLs. Path traversal plus a URL fragment lets an unauthenticated attacker place malicious ONNX models beside a target file. The models read the file as ONNX external data and encode its bytes into the returned PNG. This issue affects SAM's sammodel in 2.0.81 and returns complete file contents. Screenshot 1 — First unauthenticated request primes the path and returns HTTP 500. Technical details rembg/commands/scommand.py:188-223,384-397 accepts public extras JSON and passes it to newsession(). rembg/sessions/sam.py:313-355 inserts sammodel into encoder/decoder filenames and fixed GitHub URLs, then invokes pooch.retrieve() without a pinned hash. Requests removes the URL #fragment; the local POSIX path retains it. Pooch creates attacker-selected parent directories without enforcing cache containment. The first request creates the path tree and returns HTTP 500. The identical second request downloads the attacker asset twice and stores it as both SAM models beside the target. The graph uses a relative external tensor to read the target and maps every byte to mask pixels.…

curl https://cve.zerocrew.in/api/cve/CVE-2026-115924