A critical flaw in Pillow exposes Python users to code execution via crafted images. The vulnerability, identified as CVE-2026-112900, allows an attacker to execute arbitrary code on a server by specifying the name of a file that Pillow is told to open. Until users upgrade to version 13.0.0, they should take several precautions to protect themselves from the vulnerability.
The Python programming community has been left reeling after a critical flaw was discovered in the widely used Pillow image library. The vulnerability, identified as CVE-2026-112900, allows an attacker to execute arbitrary code on a server by specifying the name of a file that Pillow is told to open.
Pillow, the most widely used image library for Python, is used in a multitude of applications, including web upload forms, avatar and thumbnail tools, document and PDF pipelines, and most machine-learning projects. The library is downloaded approximately 436 million times a month, making it a prime target for hackers.
The flaw, which was discovered by researchers at OX Security, occurs when Pillow opens an EPS image, which it does by passing the file's name to Ghostscript, a separate program that turns the image into pixels. The issue arises when Ghostscript can read the name chosen by the attacker as instructions rather than as a file, and points it to a second file that carries commands to run.
"The flaw is triggered by the filename, not by anything in the PostScript document," the advisory states, meaning that a harmless EPS file can still cause damage when an attacker sets its name. This makes upload endpoints that keep or build a stored file's name from user input the realistic target.
The vulnerability only affects hosts that have the gs program installed, which Pillow needs to open EPS at all. It affects Pillow versions from 2.6.0 up to 12.3.0, with the most recent version, 13.0.0, already released and patched.
Researchers at OX Security, who reported the vulnerability, estimate that the library is affected by the flaw in millions of users. The maintainers of Pillow rate the vulnerability as moderate, but GitHub's CVE record assigns it a critical rating of 9.2 out of 10, indicating a significant risk to users.
There are currently three distinct vulnerabilities in Pillow, all of which have been patched in version 13.0.0. The first, CVE-2026-112393, is a memory buffer overflow flaw that has been present since 2013. The second, CVE-2026-112403, is a similar overflow flaw that can execute an attacker's command from a single call to Image.open() on a crafted file, as long as the optional olefile package is installed.
The third flaw, CVE-2026-112900, is the one that was discovered by OX Security and has received the most attention. It allows an attacker to execute arbitrary code on a server by specifying the name of a file that Pillow is told to open.
Until users upgrade to version 13.0.0, they should take several precautions to protect themselves from the vulnerability. For EPS images, they should keep the gs program off any host that processes untrusted uploads, and never pass an attacker-controlled filename to Image.open(). For JPEG thumbnails, they should avoid draft() and thumbnail() on untrusted JPEGs, or call load() first, or pass reducing_gap=None.
Users who are affected by the vulnerability should immediately update to version 13.0.0, which includes all of the necessary patches. If they are unable to upgrade, they can follow the guidance outlined in Pillow's security page and advisories to reduce their risk.
The discovery of this critical flaw in Pillow serves as a reminder that even the most widely used libraries can be vulnerable to security risks. It highlights the importance of keeping software up-to-date and being vigilant about potential security threats.