Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
CVE-2026-112900 turns Pillow's EPS-to-Ghostscript handoff into an RCE vector, threatening any Python service that processes untrusted images — a pattern widespread in European e-commerce and SaaS backends.
Summary written by editorial AI · Source link below
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open.
The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.
Editorial Analysis
Pillow is a near-ubiquitous Python dependency; unpatched instances accepting user uploads create an easy initial-access path, especially in containerised microservice architectures common in European enterprises.
Scan all Python environments for vulnerable Pillow versions and either patch immediately or disable EPS image support via Pillow's feature flags.
A critical code-execution flaw in a widely deployed open-source image library may expose any service processing user-uploaded images to remote compromise.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Vulnerabilities Desk
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers1d
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software2d
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks3d
- HPE patches eight max severity RCE and auth bypass AOS flaws3d
- Compromised TLS Certificates3d