As cited
Copy frozen at (site build).
vulnerabilities
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Pillow, Python's most widely used image library, contains a critical vulnerability (CVE-2026-112900, CVSS 9.2) that allows remote code execution through a crafted EPS image. The flaw arises because Pillow passes unsanitized file names to Ghostscript without validation when processing EPS files.
Why it matters: Organizations running Python applications that process user-supplied images with Pillow face immediate risk of server compromise and arbitrary command execution; patching or disabling EPS support should be prioritized.
- Source published
- First seen by Cybersecurity Tracker