I’M UNDER A CYBER ATTACK

Alert

Alert 2026-122 Critical vulnerability in Pillow for Python

Affected product(s): 

ProductAffected versions
Pillow (pip package)From 2.6.0 through 12.3.0 (earlier than 13.0.0)

Affects only systems with Ghostscript (gs) installed where the application opens EPS images with an attacker-controlled filename.

Description

An argument injection vulnerability has been disclosed in Pillow, the Python image-processing library, identified as CVE-2026-112900 (CVSSv4 9.2 – CRITICAL). An attacker who controls the filename passed to Image.open() can inject arguments into the Ghostscript command line when processing EPS images and, under certain conditions, execute arbitrary commands on the system.

The flaw is in the Ghostscript() function of the EpsImagePlugin module, which builds the Ghostscript command by placing the input file path after -f without validating it or converting it to an absolute path. A filename beginning with - is interpreted by Ghostscript as an option. A filename in the format @<path> causes Ghostscript to read additional arguments from that file; if the attacker also controls its contents, they can escalate to command execution.

The issue originates in the filename rather than its contents, so a legitimate EPS file can also trigger it. The attack works with Pillow’s default invocation, which includes Ghostscript’s -dSAFER option. The advisory includes a public proof of concept that executes commands on the system. As of the date of this bulletin, no active exploitation is known, and the CVE is not listed in CISA’s KEV catalog.

Mitigation

If it is not possible to update immediately, Pillow’s security policy recommends:

  • Block EPS files at the application’s input layer, before passing them to Pillow, or restrict the accepted formats with Image.open(..., formats=...).
  • If EPS processing is necessary, run Ghostscript in an isolated environment with no network access or access to sensitive mounts.

Additionally, it is recommended not to use user-supplied filenames when opening images with Pillow.

https://pillow.readthedocs.io/en/stable/handbook/security.html

Solution

The solution is to update Pillow to version 13.0.0 or later, released on 16/10/2026. The fix converts the filename to an absolute path before passing it to Ghostscript. Containers, base images, and packages that include an earlier copy of the library must also be rebuilt.

pip install -U "Pillow>=13.0.0"

Pillow 13.0.0 no longer supports Python 3.10, so those environments must migrate to Python 3.11 or later.

Release notes for 13.0.0:

https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

Package on PyPI:

https://pypi.org/project/pillow/

Additional information: