CVE-2023-36664-Ghostscript-command-injection

Ghostscript command injection vulnerability PoC CVE-2023-36664 Vulnerability disclosed in Ghostscript prior to version 10.01.2 leads to code execution CVSS score 9.8. Official vulnerability description: Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices with the...

GHSA-W889-685W-C8FH Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Summary PIL.EpsImagePlugin.Ghostscript builds the Ghostscript command line using the input file path fp.name without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE see Impact...

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Summary PIL.EpsImagePlugin.Ghostscript builds the Ghostscript command line using the input file path fp.name without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE see Impact...

EUVD-2026-104661

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE...

CVE-2025-48708

CVE-2025-48708 Description A vulnerability in Artifex Ghostscript before version 10.05.1 causes the plaintext password used to protect a PDF file to be embedded in the output. The issue is due to a lack of argument sanitization in gslibctxstashsanitizedarg base/gslibctx.c, particularly when...

CVE-2026-112899

When an application opens an untrusted Encapsulated PostScript file and asks Pillow to render it at a larger scale, Pillow has Ghostscript produce an image several times bigger than Pillow's configured size limit allows. The size check runs only after Ghostscript has finished rendering and writte...

GHSA-VX6W-VV9F-6GVG Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

============================================================================ EPS loadscale lets Ghostscript render past the decompression bomb limit Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

============================================================================ EPS loadscale lets Ghostscript render past the decompression bomb limit Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript Commit: a707c6b21c313880d0771e54965d142dd42358b6...

CVE-2024-29510

Original research and POC code: https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/ NOTE: I have made no changes to the POC apart from the command executed. Full credit goes to Thomas Rinsma @ Codean Labs for their amazing research and POC. Local Scenario 1...

DEBIAN-CVE-2026-112900

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2018-16509

CVE-2018-16509 Docker Playground "An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction."...

CVE-2026-112177

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

CVE-2026-112177 Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

CVE-2026-112177

A flaw exists in Ghostscript as shipped with Red Hat Enterprise Linux 8 due to the omission of a previous security correction during a version rebase from 9.25 to 9.27. Specifically, privileged .forceput operations in the .charkeys procedure are insufficiently protected. Processing a specially cr...

EUVD-2026-104827

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

CVE-2026-112177 Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

CVE-2026-112177

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

PIL-CVE-2017-8291

Python PIL Remote Command Execution Vulnerability GhostButt The PIL Pillow module for processing images in Python is affected by the GhostButt vulnerability CVE-2017-8291 because it calls GhostScript internally, resulting in a remote command execution vulnerability. Vulnerability Summary PIL...

PT-2026-118259

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-112900

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input...