CVE-2026-112900
Argument injection in Pillow's Ghostscript call allows remote code execution
An argument injection vulnerability exists in Pillow when it calls Ghostscript to process EPS images. An attacker who controls the image filename can inject Ghostscript arguments, potentially leading to arbitrary command execution. All Pillow versions from 2.6.0 to before 13.0.0 are affected. The issue is fixed in Pillow 13.0.0.
python-pillow Pillow · Updated 28 Oct · From the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 9.2 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Pillow (pip) 13.0 | 13.0.0 |
What to do
- Update Pillow to version 13.0.0 to fix the vulnerability.
- If you cannot update immediately, avoid processing EPS files from untrusted sources.
What happened
- 21 OctGitHub published a security advisory for the vulnerability.
- 23 OctThe Hacker News reported the critical flaw in Pillow.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-112900 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE | critical 9.2 | No | 1.1% |
Our reporting
We have not reported on it. It is here because the sources below did.
Reported elsewhere
The Hacker News · 23 OctCritical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image ↗GitHub · 21 OctPillow: Argument Injection in Ghostscript call, potentially leading into RCE ↗The records
CVE-2026-112900 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works