🔴 Critical: Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
-
Pillow, the widely used image processing library for Python, has a serious security issue that could allow attackers to execute operating system commands on a server. The vulnerability is tracked as CVE-2026-112900 and stems from how Pillow handles EPS image files.
When opening an EPS image, Pillow passes the file name to Ghostscript, a separate program it invokes to convert the image into pixels. The problem is that Pillow does this without validating or checking the file name first, which opens the door to command injection. An attacker who can supply a crafted image could abuse this behavior to run arbitrary OS commands on the affected server.
Key points:
- Affected component: Pillow EPS image handling
- Root cause: file names passed to Ghostscript without validation
- Impact: potential operating system command execution
- Attack vector: a crafted image supplied to the application
If your applications accept user-uploaded images and use Pillow to process them, this is worth prioritizing. Review any code paths that open EPS files, and consider restricting EPS processing or isolating image conversion from the host environment until a fix is available.
Source: The Hacker News
Does your organization process user-supplied images with Pillow, and if so, how are you planning to mitigate this?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login