vulnerability
Imported story
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Source: The Hacker News · Published · Last checked 10 hours ago · 1 min read
Read original source ↗ (thehackernews.com)
Publisher excerpt From The Hacker News
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.
Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.