Pillow Hit by Critical Flaw Allowing Command Execution via Filename

A critical vulnerability CVE-2026-112900 in the popular Python imaging library Pillow allows OS command execution triggered simply by a crafted filename, as EPS filenames are passed unvalidated to Ghostscript.

2026-10-23 ~ 2026-10-24 · 2 related posts

• Pillow Critical Flaw CVE-2026-112900: A Filename Alone Can Trigger OS Command Execution — basedjensen · 2026-10-23
• Pillow CVE-2026-112900: A Filename Alone Can Trigger OS Command Execution via Ghostscript — banteg · 2026-10-24