CVE-2026-112900 in Pillow
Summary
by MITRE • 10/20/2026
Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading @ argument-file filename and control of the referenced text file containing additional Ghostscript arguments; the reported chain reproduces with the default -dSAFER invocation. This issue is fixed in version 13.0.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The Pillow library, widely utilized as a core Python imaging tool for processing various image formats including Encapsulated PostScript (EPS), contained a critical argument injection vulnerability affecting versions from 2.6.0 through 13.0.0. This flaw resides within the EpsImagePlugin module, specifically in the Ghostscript invocation logic used to render EPS files. The underlying technical deficiency stems from how the library handles user-supplied input filenames when passing them as arguments to the external Ghostscript command-line utility. Instead of sanitizing or converting the filename into a safe absolute path that prevents interpretation as program options, Pillow passes the caller-controlled string directly after the -f flag. This design oversight allows an attacker who controls the filename component to inject arbitrary Ghostscript arguments by exploiting the way the shell and Ghostscript parse subsequent parameters.
The operational impact of this vulnerability is severe because it enables potential remote code execution under specific conditions. While simple argument injection can disrupt processing or cause denial-of-service, full command execution requires a more complex attack chain involving an @-prefixed filename. In Ghostscript syntax, a leading at-sign indicates that the following string should be treated as a file containing additional arguments rather than a direct input file. If an attacker controls both the initial EPS filename and can influence or control the contents of the referenced text file, they can inject arbitrary commands into the Ghostscript execution context. Notably, this exploitation chain was demonstrated to succeed even when Ghostscript is invoked with the -dSAFER flag, which is typically designed to restrict dangerous operations such as shell command execution by limiting access to system resources and disabling certain operators.
From a classification perspective, this vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The root cause lies in the failure to properly validate or encode user input before it is incorporated into a command string executed by the operating system shell. In terms of adversary tactics and techniques, this flaw facilitates lateral movement and privilege escalation scenarios consistent with ATT&CK technique T1059 Command and Scripting Interpreter, where attackers leverage legitimate software utilities like Ghostscript to execute malicious payloads without triggering traditional security controls that might look for standalone malware binaries.
To mitigate the risks associated with this vulnerability, organizations must ensure that all instances of Pillow are upgraded to version 13.0.0 or later, which includes patches addressing the argument injection flaw in the EPS handling logic. For environments where upgrading is not immediately feasible, defensive measures should include implementing strict input validation on any file paths passed to image processing functions, ensuring that filenames do not contain special characters such as hyphens at the start of strings unless explicitly sanitized. Additionally, deploying application-level controls that restrict access to external command execution and monitoring for unusual subprocess activity involving Ghostscript can provide an additional layer of defense against exploitation attempts targeting this specific weakness in legacy deployments.