Your Python application might be executing operating system commands just because it processed an image upload, because a critical Pillow EPS vulnerability allows attackers to run arbitrary code by manipulating a filename, and since Pillow is downloaded about 436 million times a month, the blast radius across web forms, document pipelines, and machine-learning projects is massive.

The flaw is tracked as CVE-2026-112900, it affects Pillow versions from 2.6.0 up to 12.3.0, and the maintainers fixed it in version 13.0.0, which was released on October 16.

How the Pillow EPS Vulnerability Triggers Command Execution

To understand the flaw, you have to look at how Pillow handles EPS images, because it opens them by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.

Ghostscript can read a name chosen by an attacker as instructions rather than as a file, and point it to a second file that carries commands to run. The weakness is the filename, not the picture itself, which means a harmless EPS file can still cause damage when an attacker sets its name.

That makes upload endpoints that keep or build a stored file's name from user input the realistic target.

The maintainers rate this flaw as moderate because the attacker has to control the filename, but the CVE record assigned by GitHub rates it 9.2 out of 10, which is a critical score. The flaw only reaches Ghostscript on hosts that have the gs program installed, which Pillow needs to open EPS files at all.

The Other Critical Flaws in Pillow 13.0.0

Version 13.0.0 is a large security release with fixes across four severity levels, and two of the other flaws are rated critical by the maintainers.

The FlashPix Flaw

One of the JPEG flaws sits in the FlashPix (FPX) format, and it was shown to run an attacker's command from a single call to Image.open() on a crafted file, as long as the optional olefile package is installed.

Pillow recognizes these files by their content, not their extension, so a server that opens untrusted uploads can be hit with no user action at all.

The TIFF Vulnerabilities

The TIFF flaw, CVE-2026-112393, has been in Pillow since 2013, and it overflows a memory buffer when a program saves a compressed TIFF image to memory rather than to a file on disk, which is the common pattern for a service that re-encodes an upload and hands it back.

The advisory says the reporters crashed the process with it, and turned it into code execution only with the help of a second, separate flaw that leaked memory addresses. Saving to a real file on disk is not affected.

Another JPEG flaw, CVE-2026-112403, overflows a memory buffer when a program makes a thumbnail of a crafted lossless JPEG, and its advisory reports a crash, not code execution. The advisory notes it was found by Anthropic using Claude to study the security of open-source software, and validated manually by Ada Logics.

How to Patch and Secure Your Python Environment

Upgrading to Pillow 13.0.0 fixes all of these flaws, but you must also rebuild any containers, wheels, or base images that bundle an older copy, because they will continue to ship the vulnerable version.

Pillow 13 drops Python 3.10, so installs still on 3.10 need Python 3.11 or newer as well.

To update, run:

pip install -U "Pillow>=13.0.0"

Until you can upgrade, use these mitigations to cut off each attack path:

• EPS / Ghostscript: Keep the gs program off any host that processes untrusted uploads, and never pass an attacker-controlled filename to Image.open() for EPS.
• JPEG thumbnails: Avoid draft() and thumbnail() on untrusted JPEGs, or call load() first, or pass reducing_gap=None.
• TIFF: Treat saving a TIFF to an in-memory buffer such as io.BytesIO as a sensitive path when the image came from a user.

FAQ

What is CVE-2026-112900?

It is a vulnerability in Pillow's EPS handling that allows an attacker to execute operating system commands by manipulating the filename passed to Ghostscript.

Does this affect all Pillow installations?

The EPS flaw only affects hosts that have the Ghostscript gs program installed. However, other critical flaws in the same release, such as the FPX format bug, affect standard image processing paths.

How do I fix the Pillow EPS vulnerability?

Upgrade to Pillow version 13.0.0 or later. You must also rebuild Docker images or wheels that contain old versions, and make sure that you have Python 3.11 or later installed.

Is there a workaround if I can't upgrade immediately?

Yes. Remove Ghostscript from any host processing untrusted uploads, avoid passing user-controlled filenames to Image.open() for EPS files, and avoid using thumbnail() or draft() on untrusted JPEGs.

What is the difference between the maintainer's rating and the CVE rating?

Maintainers consider the problem of EPS to be moderate since the attacker has to be able to control the filename, while the CVE entry on GitHub gives it a critical rating of 9.2, reflecting the severe impact if that condition is met.

Source: The Hacker News