CVE-2026-112900

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

No known exploitation. EPSS puts it in the 64th percentile. No fix published yet.

CVSS —Not scored EPSS percentile64th1.1% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-10-19Updated 2026-10-20Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

python-pillow PillowAffected: >= 2.6.0, < 13.0.0Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your website, app, or internal tools use Python and the Pillow image library, especially any feature that processes EPS image files.
Ask your developer or vendor to confirm the exact Pillow version in use (versions from 2.6.0 up to, but not including, the fixed release are affected).
If you process EPS files from users or other untrusted sources, have that feature disabled or restricted until a confirmed patch is applied.
Have your developer upgrade Pillow to the fixed version referenced in the vendor's advisory (reported as 13.0.0) once it is officially released and confirmed.
Re-check with your developer periodically, since official patch details were not yet confirmed at the time of this report.

May need vendor or contractor work

What it is

From the CVE record

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading @ argument-file filename and control of the referenced text file containing additional Ghostscript arguments; the reported chain reproduces with the default -dSAFER invocation. This issue is fixed in version 13.0.0.

In plain language

Written by AI from the record

This is a flaw in Pillow, a common Python tool for processing images, that could let a specially crafted file trick the program into running extra commands — but there's no sign anyone is exploiting it, so most small businesses don't need to act urgently right now.

Argument injection in Pillow's EpsImagePlugin.Ghostscript() (CWE-78/88) occurs because an attacker-controlled EPS filename is passed unsanitized after the `-f` flag, letting a hyphen-prefixed or `@`-prefixed filename be interpreted as a Ghostscript option/argument-file, potentially enabling command execution under specific conditions (attacker control of a referenced argument file).

If you're affected

Server command execution risk
Image-processing pipeline compromise
Possible data exposure via server access
Operational disruption if exploited

What is it

Pillow is a widely used tool that lets software open, edit, and convert images, including a special image format called EPS. This bug is like a mailroom clerk who reads a shipping label and, if it starts with the wrong character, treats it as an instruction instead of an address — in this case, a malicious filename could trick the underlying image-processing engine into running unintended commands instead of just opening a picture.

Who is affected

This matters to you if your website, app, or internal tools use Python's Pillow library to open or convert EPS image files — for example, through a user-upload or document-conversion feature. It is only a realistic risk if attackers can control or supply the filename being processed (such as through an upload feature) and, for full command execution, also control a referenced argument file on the system.

How urgent is it

There is no evidence of attackers exploiting this flaw in the wild, no public exploit code, and it is not on any government list of actively-exploited vulnerabilities. This is a low-urgency issue for now — worth tracking and fixing in your normal update cycle rather than treating as an emergency.

What to do — in detail

Identify all services using Pillow and determine whether any accept or process EPS files from untrusted input (user uploads, third-party integrations, document conversion pipelines).
Confirm the installed Pillow version; versions 2.6.0 up to the fix are affected per the vendor's description.
No official patch advisory with a confirmed fixed version is currently available from tracked patch sources; the underlying technical report references version 13.0.0 as the intended fix, but this should be verified against Pillow's official release notes/changelog before relying on it.
As a temporary mitigation while confirming patch availability: avoid passing user-controlled filenames directly to EpsImagePlugin/Ghostscript, enforce strict filename sanitization (reject filenames starting with '-' or '@'), and consider disabling EPS processing for untrusted input, or sandbox/isolate the Ghostscript invocation.
Once a confirmed fixed release is published, upgrade Pillow and re-test EPS handling, since this involves a change in path/filename handling.
Not listed in CISA KEV, so there is no federal remediation deadline; monitor vendor advisories and the NVD entry for an official fix confirmation and reassess priority if exploitation evidence emerges.

Technical context

Weakness: CWE-78 (OS Command Injection) / CWE-88 (Argument Injection), triggered via EpsImagePlugin.Ghostscript() passing an unsanitized, caller-controlled filename after the -f flag to Ghostscript, allowing hyphen- or @-prefixed filenames to be interpreted as options/argument files. Exploitation status: not in CISA KEV, no public exploit code identified, predicted exploitation likelihood is low with a flat trend. Attack vector requires attacker control of the input filename and, for full remote code execution, control of a referenced Ghostscript argument file, with the reported chain reproducing even under the default -dSAFER invocation. Patch status: no confirmed official fix/patch tracking information is currently available; the vendor-reported description cites version 13.0.0 as the remediation, pending independent confirmation. Press attention is newly emerging but reflects disclosure interest, not confirmed in-the-wild exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.