Arbitrary Expression Execution Vulnerability in Pillow by Python Software Foundation
CVE-2022-22817

9.8CRITICAL

Key Information:

Vendor: Python
Status: Pillow
Vendor: CVE Published:; 10 January 2022

Badges

👾 Exploit Exists

What is CVE-2022-22817?

A vulnerability in Pillow allows users to evaluate arbitrary expressions through the PIL.ImageMath.eval method. This flaw can be exploited to execute potentially harmful code, including lambda expressions and the Python exec method, if the input is not properly sanitized. Users of Pillow versions prior to 9.0.0 are particularly at risk. It's crucial for developers and system administrators to update to the latest version to mitigate this risk.