Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Summary: Pillow, the widely used Python image library, has a flaw tracked as CVE-2026-112900 in which it passes an EPS file's name to Ghostscript without checking it, letting an attacker-controlled filename be read as instructions that point to a second file of commands. The maintainers fixed it in version 13.0.0, released October 16, a release that also addresses two critical-tier issues including JPEG decoding overflows, and OX Security estimates the library is downloaded about 436 million times a month.
What you should know: The weakness is the filename, not the picture, so any upload endpoint that builds a stored file's name from user input is the realistic target - and the flaw reaches Ghostscript only on hosts with the gs program installed, which Pillow needs to open EPS at all. Pillow 13.0.0 also drops Python 3.10, so installs still on 3.10 need Python 3.11 or newer as well.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-112393CVE-2026-112403CVE-2026-112900
- Related
- ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026