AIKIDO-2026-273038
rembg is vulnerable to Server-Side Request Forgery (SSRF)
53
Medium Risk
This Affects:
rembgTL;DR
The rembg s HTTP server validates the user-supplied ?url= parameter of /api/remove against a private/internal-IP blocklist only on the initial URL, then fetches it with aiohttp using the default allow_redirects=True. A public host that returns an HTTP 3xx redirect to an internal address is followed without re-validation, and the same validate-once pattern is also reachable via DNS rebinding since the connection is not pinned to the validated IP. An unauthenticated remote caller can make the server reach loopback, link-local cloud-metadata (169.254.169.254), and other internal services, bypassing the earlier SSRF control. The fix disables blind redirects, re-validates redirect hops, pins outbound connections to the validated IP via a custom resolver, expands blocked-address checks, and caps the fetched response size.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
rembg is vulnerable to Server-Side Request Forgery (SSRF) in versions 2.0.75 - 2.0.76.
How to fix this
Upgrade the rembg library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant