Rembg (< 2.0.82)

Unauthenticated attackers can exploit a path traversal vulnerability in the Rembg /api/remove endpoint to download malicious ONNX files, leading to arbitrary ONNX computation and file disclosure.