CVE-2026-115924 - Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
CVE ID :CVE-2026-115924 Published : Oct. 26, 2026, 7:22 p.m. | 1 hour ago Description :Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model through rembg/commands/s_command.py to rembg/sessions/sam.py, where...