ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-112900

Pillow is a Python imaging library.

Published Oct 19, 2026 · catalog updated Oct 21, 2026 · Pillow is a Python

Last checked Oct 31, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-112900. EPSS is 1.30%. Act only if a listed version of Pillow is a Python is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Pillow is a Python).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Critical9.2
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
1.30%
Remediation
Version ranges on file
Affected products
pip Pillow · pypi pillow · vendor python-pillow

### Summary builds the Ghostscript command line using the input file path ( ) **without sanitization**, placing it at . A filename beginning with is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with enabled). ### Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ #### Type CWE-88 (Argument Injection) (→ CWE-78 (OS Command Injection) optionally, with attacker controlled text file) #### Vulnerable Codes #### Root cause. When rendering an EPS image, PIL.EpsImagePlugin.Ghostscript() constructs the Ghostscript command line using the input file path (fp.name) and places it directly at the -f position of the argument list. This path is user-controllable, yet Pillow performs no validation or neutralization of tokens that Ghostscript treats specially during command-line argument parsing — in particular a leading - or -- (which Ghostscript interprets as an option rather than a filename) and a leading @ (Ghostscript's argument-file syntax, which causes it to read additional command-line arguments from the named file). Because the filename is neither normalized (e.g., forced to an absolute path or prefixed with ./) nor checked against these prefixes before being handed to the subprocess, an attacker who controls the filename passed to Image.open() can inject arbitrary Ghostscript command-line arguments. This is a classic argument-injection flaw (CWE-88), and it is not mitigated by Pillow's default -dSAFER setting. #### Affected - Pillow: tested on 12.3.0 (latest); vulnerable code is long-standing and appears to affect all current versions (main included). - Component: , — , and the command list entry . #### Suggested fix Normalize the filename to an absolute path before it is passed to Ghostscript, so it can never be parsed as an option ( / ) or as an argument-file token ( ): guarantees the pat

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • pip Pillow>= 2.6.0, < 13.0.0
  • pypi pillowversion unspecified
  • vendor python-pillowversion unspecified

How to fix CVE-2026-112900

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-112900. EPSS is 1.30%. Act only if a listed version of Pillow is a Python is installed.

Which versions are affected?

Compare what you have installed with Pillow >= 2.6.0, < 13.0.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-78: OS Command Injection; CWE-88. EPSS 1.30%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Pillow security

Code

The project this record applies to. Exploit listings stay in References.

Related records

Linked stories and findings that share CVE identifiers or explicit correlation edges.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 19, 2026 · EUVD

    Detected

    Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Gho

  2. Oct 20, 2026 · NIST NVD

    Updated

    Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Gho

  3. Oct 20, 2026 · NIST NVD

    Updated

    Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Gho

  4. Oct 21, 2026 · GitHub Advisory Database

    Updated

    ### Summary builds the Ghostscript command line using the input file path ( ) **without sanitization**, placing it at . A filename beginning with is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with enabled). ### Details _Give all details on the vulnerability. Pointing to the incriminate

Sources

  • CVE.orgVulnerability recordCVE-2026-112900

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-112900

    30-day exploitation probability 1.30%

    first.org
  • EUVDVulnerability recordEUVD-2026-104661

    Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name

    euvd.enisa.europa.eu
  • GitHub Advisory DatabasePackage advisoryGHSA-w889-685w-c8fh

    Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-112900

    PIL.EpsImagePlugin.Ghostscript() builds the Ghostscript command line using the input file path (fp.name) without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with -dSAFER enabled).

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-112900

    Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name

    nvd.nist.gov
  • urlscan.ioThreat intelligenceCVE-2026-112900
    urlscan.io

References

Freshness

Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSOct 31, 2026
  • urlscan.ioOct 31, 2026
  • GitLab Advisory DatabaseOct 23, 2026
  • GitHub Advisory DatabaseOct 22, 2026
  • CVE.orgOct 21, 2026
  • NIST NVDOct 21, 2026
  • EUVDOct 20, 2026