Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

October 23, 2026 · 9:36 am 1 sources

Image: The Hacker News

Coverage

More coverage

• Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
  The Hacker News · October 23, 2026 09:36
  Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a…