Security · Updated 23 Oct, 03:06 pm IST
Critical Pillow EPS flaw lets crafted images run OS commands
Why it matters for readers: It’s an example of how passing unchecked input (a filename) to another program (Ghostscript) can let attackers run commands.
- Pillow passes an EPS file’s name directly to Ghostscript, creating a command-injection risk.1
- The flaw is tracked as CVE-2026-112900 and affects how Pillow handles EPS images.1
- An attacker can craft an EPS filename that causes the server to run operating-system commands when Pillow opens the file.1
- Pillow is described as the most widely used image library for Python, so servers that process untrusted EPS files are at risk.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started