Pillow CVE-2026-112900: A Filename Alone Can Trigger OS Command Execution via Ghostscript
banteg · x · 2026-10-24
A high-severity vulnerability, CVE-2026-112900, has been disclosed in Python's widely used Pillow image library: a filename alone is enough to trigger OS command execution. The flaw stems from how Pillow passes EPS filenames to Ghostscript, letting attackers run arbitrary commands on systems that process untrusted images. Services handling user-uploaded images should patch immediately.
Related event: Pillow Hit by Critical Flaw Allowing Command Execution via Filename(2 posts)→
More from Safety
- PSA: After AI's cybersecurity turning point, do this weekend security cleanup — leveragedupside · 2026-10-24
- 70k credentials leaked in Fortinet attacks; researcher says an LLM code review would cost less than one appliance — cyb3rops · 2026-10-24
- Railway publishes preliminary report on its October 21st security incident — edgarpavlovsky · 2026-10-24
- HarmAmp benchmark shows LLMs amplify harm over multi-turn chats; TrajSafe monitor intervenes early — alan_ritter · 2026-10-24
- Weeks later: still no word on METR and Redwood returning to resume safety investigation — DKokotajlo · 2026-10-24
- Meta's new commercial terms put legal liability for AI mistakes on customers — esporx · 2026-10-24