GHSA-W889-685W-C8FH Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Summary PIL.EpsImagePlugin.Ghostscript builds the Ghostscript command line using the input file path fp.name without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE see Impact...