When opening an EPS image, Pillow passes the file name to Ghostscript, a separate program it invokes to convert the image into pixels. The problem is that Pillow does this without validating or checking the file name first, which opens the door to command injection. An attacker who can supply a crafted image could abuse this behavior to run arbitrary OS commands on the affected server.

Key points:

• Affected component: Pillow EPS image handling
• Root cause: file names passed to Ghostscript without validation
• Impact: potential operating system command execution
• Attack vector: a crafted image supplied to the application

If your applications accept user-uploaded images and use Pillow to process them, this is worth prioritizing. Review any code paths that open EPS files, and consider restricting EPS processing or isolating image conversion from the host environment until a fix is available.

Source: The Hacker News

Does your organization process user-supplied images with Pillow, and if so, how are you planning to mitigate this?