Argument Injection Vulnerability in Pillow Python Imaging Library

CVE-2026-112900

What is CVE-2026-112900?

Pillow, a widely used Python imaging library, is susceptible to an argument injection vulnerability found in its EpsImagePlugin when utilizing Ghostscript for EPS inputs. This flaw arises from the inadequate sanitization of caller-controlled input filenames, which can lead to the execution of arbitrary commands if manipulated correctly. An attacker can leverage this vulnerability by providing a filename that starts with a hyphen, causing it to be misinterpreted as a Ghostscript option. Through this vector, an attacker can insert additional commands, posing significant security risks. The issue has been addressed in version 13.0.0, and users are advised to upgrade to mitigate potential threats.

References