BIT-PILLOW-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

PT-2026-123487

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

EUVD-2026-104661

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE...

CVE-2026-112900

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112900

The Pillow Python imaging library (versions 2.6.0 through 13.0.0) is vulnerable to argument injection during the processing of EPS input via Ghostscript . The EpsImagePlugin.Ghostscript component fails to convert caller-controlled input filenames to safe absolute paths when passed to the -f flag;...

CVE-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

Pillow command injection vulnerability

Pillow versions from 2.6.0 to 13.0.0 contain a command injection vulnerability. This vulnerability arises from parameter injection when calling Ghostscript to process EPS inputs. In EpsImagePlugin.Ghostscript, the input file name controlled by the attacker is passed after the -f parameter without...

PT-2026-117686

Name of the Vulnerable Software and Affected Versions Pillow versions 2.6.0 through 12.11.0 Description Argument injection occurs when invoking Ghostscript for EPS input. The EpsImagePlugin.Ghostscript function passes a caller-controlled input filename after the -f flag without converting it to a...