Key points
- The vulnerability affects Pillow versions from 2.6.0 up to, but not including, 13.0.0.
- Attackers can inject Ghostscript arguments by controlling the filename used for EPS image processing.
- Arbitrary command execution is possible if an attacker controls a referenced argument file.
Pillow version 13.0.0 is now available and resolves a critical security flaw identified as CVE-2026-112900. The National Vulnerability Database rates this issue with a CVSS score of 9.2. The vulnerability exists in how the library handles Encapsulated PostScript (EPS) files. It involves improper handling of inputs passed to the Ghostscript program during image processing tasks. This flaw allows for argument injection, a serious weakness that can lead to remote code execution under specific conditions involving file control.
In plain English
When Pillow processes an EPS file, it calls out to Ghostscript to render the image. The code passes the filename provided by the user directly to the Ghostscript command line. It does not convert this filename into a safe absolute path first. If a filename starts with a hyphen, Ghostscript interprets it as a command-line option rather than a file name. This allows an attacker to inject their own arguments into the command execution.
The background
This specific chain of events requires an attacker to control the filename passed to the library. According to the NVD record, the reported reproduction chain works even when Ghostscript is invoked with the default -dSAFER mode. While simple argument injection is the primary flaw, achieving arbitrary command execution requires a specific setup. The attacker must use a filename starting with the @ symbol to reference an external text file. This file must contain additional Ghostscript arguments that the attacker also controls.
Who needs to act first
Security teams should prioritize updating systems that process untrusted EPS files from external users or web uploads. Identify applications that rely on Pillow for image manipulation and check their current version against the affected range. Roll out the update to production environments after testing in a staging area to ensure compatibility with existing workflows. If immediate patching is not possible, restrict input to trusted file names and block any filenames containing special characters like hyphens or the at symbol.
What to do and how to stay safe: Pillow
- Scan your inventory for Python applications using Pillow and identify those processing user-supplied EPS files.
- Update Pillow to version 13.0.0 or later as soon as your testing confirms stability.
- Implement input validation to reject filenames starting with hyphens or special characters until patched.
- Monitor logs for unexpected Ghostscript executions or arguments injected via file names.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Pillow are affected by CVE-2026-112900?
The vulnerability affects Pillow versions from 2.6.0 up to, but not including, 13.0.0.
Is there a patch available for this vulnerability?
Yes, the issue is fixed in version 13.0.0 of the Pillow library.
What weaknesses are associated with this CVE?
The NVD record associates this flaw with CWE-78 (Improper Neutralization of Special Elements) and CWE-88 (Argument Injection).
