Critical Flaw in Python's Pillow Library Enables Code Execution via Crafted Images
A critical vulnerability in Python's widely-used Pillow image library allows attackers to execute arbitrary OS commands by crafting a malicious EPS image file.
A critical vulnerability, identified as CVE-2026-112900, has been discovered in Python's Pillow image processing library, a component that underpins a vast array of applications handling images. The flaw enables attackers to execute arbitrary operating system commands on a server by tricking the library into processing a specially crafted Encapsulated PostScript (EPS) image file. This is achieved by exploiting how Pillow interacts with the external Ghostscript interpreter.
The vulnerability arises from Pillow's practice of passing the filename of an EPS image directly to the Ghostscript interpreter without adequate sanitization. Ghostscript, a powerful PostScript and PDF interpreter, can be instructed to interpret filenames not as file references but as commands. An attacker can leverage this by naming a malicious file in a way that, when processed by Pillow and subsequently by Ghostscript, leads to command injection on the host system.
Pillow is an indispensable library for Python developers, finding its way into numerous applications including web upload forms, avatar and thumbnail generation tools, document processing pipelines, and machine learning projects. OX Security estimates that the library is downloaded approximately 436 million times per month, highlighting the extensive potential impact of this vulnerability.
Pillow's maintainers addressed this critical issue in version 13.0.0, released on October 16th. This significant security release includes fixes for multiple vulnerabilities across various severity levels. While CVE-2026-112900 is rated as critical by GitHub with a CVSS score of 9.2, Pillow's maintainers classify it as moderate due to the requirement for an attacker to control the filename.
The advisory clarifies that the vulnerability is triggered by the filename itself, not by the content of the PostScript document. This means even a seemingly harmless EPS file can be weaponized if its name is crafted by an attacker. Consequently, upload endpoints that construct or store filenames based on user input are particularly susceptible.
This specific flaw requires the Ghostscript program (gs) to be installed on the host system, as Pillow relies on it for EPS image processing. The vulnerability affects Pillow versions ranging from 2.6.0 up to 12.3.0. Users are strongly advised to upgrade to Pillow version 13.0.0 or later to mitigate this risk.
In addition to the EPS vulnerability, Pillow 13.0.0 also addresses other critical issues, including a memory bug related to stale image data and two overflow flaws in JPEG decoding. One JPEG flaw, affecting the FlashPix (FPX) format, could allow command execution with a single Image.open() call if the olefile package is installed. Another JPEG flaw in lossless JPEG thumbnail generation can lead to a crash, and a long-standing TIFF saving vulnerability could be exploited for code execution with the aid of a separate memory leak flaw.
To remediate, users should upgrade to Pillow 13.0.0 and rebuild any affected containers or base images. For systems unable to upgrade immediately, mitigation strategies include disabling the gs program on hosts processing untrusted uploads, avoiding passing attacker-controlled filenames to Image.open() for EPS files, and implementing specific precautions for JPEG and TIFF processing as outlined in Pillow's security guidance.