Pillow Ghostscript Code Execution

The vulnerability in the Pillow image processing library’s PIL.EpsImagePlugin.Ghostscript function is related to improper handling of special elements. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Summary PIL.EpsImagePlugin.Ghostscript builds the Ghostscript command line using the input file path fp.name without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE see Impact...

GHSA-W889-685W-C8FH Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Summary PIL.EpsImagePlugin.Ghostscript builds the Ghostscript command line using the input file path fp.name without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE see Impact...