Argument Injection Vulnerability in Pillow Python Imaging Library
CVE-2026-112900

9.2CRITICAL

Key Information:

Vendor: Python-pillow
Status: Pillow
Vendor: CVE Published:; 19 October 2026

🔔 Create Python-pillow Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-112900?

Pillow, a widely used Python imaging library, is susceptible to an argument injection vulnerability found in its EpsImagePlugin when utilizing Ghostscript for EPS inputs. This flaw arises from the inadequate sanitization of caller-controlled input filenames, which can lead to the execution of arbitrary commands if manipulated correctly. An attacker can leverage this vulnerability by providing a filename that starts with a hyphen, causing it to be misinterpreted as a Ghostscript option. Through this vector, an attacker can insert additional commands, posing significant security risks. The issue has been addressed in version 13.0.0, and users are advised to upgrade to mitigate potential threats.

Affected Version(s)

Pillow >= 2.6.0, < 13.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cortex9-pillow-ghostscript-argv-injection-model
Created by federiconbaez

CVE-2026-112900-PoC
Created by kavin-jindal