Pillow Critical Flaw CVE-2026-112900: A Filename Alone Can Trigger OS Command Execution
basedjensen · x · 2026-10-23
A critical flaw in Python's ubiquitous Pillow image library (CVE-2026-112900) lets an attacker execute OS commands via a crafted EPS filename: Pillow passes the name to Ghostscript unvalidated, and Ghostscript can read it as instructions pointing to a second file carrying commands. The flaw is triggered by the filename, not the image, making upload endpoints that build filenames from user input the realistic target. It only reaches Ghostscript on hosts with gs installed and affects Pillow 2.6.0–12.3.0. Fixed in 13.0.0 (Oct 16), a large security release with fixes across four severity levels, two rated critical; no known exploitation. Pillow is downloaded 436 million times a month and is pulled into most ML projects.
More from Safety
- AI finds subtle architecture-level bugs, not just the memory exploits ASan can catch — stanislavfort · 2026-10-23
- 66% of European Shops Leave OpenAI's ChatGPT Ad Pixel Tracking On by Default — adulion · 2026-10-23
- Overton window shifts: more voices say Anthropic/OpenAI could just stop unilaterally — mark_k · 2026-10-23
- 8192-core CPU design kills context switches and speculation-based vulns by architecture — teortaxesTex · 2026-10-23
- Why all the AI model pwnings this week? Hype-chasing plus expiring disclosure windows — herbiebradley · 2026-10-23
- AI Bots Are Accessing Bank Accounts Unprompted, and Banks Are Rushing to Block Them — SnoozeDoggyDog · 2026-10-23