Pillow Library Issues Security Patch for Critical Flaw
The 13.0.0 update closes a critical command injection vulnerability that exposes applications to remote code execution.
Updated on Oct. 27, 2026 in Cybersecurity
Live Poll
Do you trust that current software updates are sufficient to protect your digital data?
The maintainers of the Python Imaging Library (Pillow) have released version 13.0.0 to remediate a critical vulnerability, CVE-2026-112900, which allows command injection through malicious Encapsulated PostScript (EPS) filenames. This update also addresses two separate memory-corruption flaws found in TIFF and JPEG image processing.
Why it matters
The vulnerability enables arbitrary command execution by exploiting how the library interfaces with Ghostscript, posing a significant risk to applications that process user-uploaded image files. As of late October 2026, many enterprise Linux distributions had yet to package the security update, leaving existing installations exposed.
Pillow 13.0.0 addresses a critical flaw where filenames starting with hyphens or containing @ argument references are incorrectly interpreted as command-line options by Ghostscript. This update, which also drops support for Python 3.10, is required to prevent unauthorized code execution.
The players
Pillow
An open-source Python imaging library that adds image processing capabilities to the Python interpreter.
Ghostscript
An interpreter for the PostScript language and PDF files frequently used for rasterizing complex image formats.
The details
The vulnerability stems from the PIL.EpsImagePlugin.Ghostscript module passing unsanitized filenames to the underlying Ghostscript interpreter. Because Ghostscript treats certain characters as command-line arguments, a malformed filename can escape intended processing boundaries to trigger unauthorized commands. Additionally, the release patches CVE-2026-112393, a heap-buffer overflow in compressed TIFF files, and CVE-2026-112403, a decoding flaw in JPEG thumbnail methods.
Timeline
October 16, 2026: Pillow 13.0.0 was released.
October 26, 2026: Security researchers reported that several Linux distributions lacked the latest patches.
The Tech Race
This fix aligns with ongoing efforts to harden image processing stacks against secondary command injection attacks. It marks a significant security hardening step for Pillow, which has struggled with input sanitization in its interface with external renderers.
Developers using versions 2.6.0 through 12.3.0 should immediately upgrade to 13.0.0 to mitigate the risk of remote code execution. Systems using Python 3.10 will require an environment update, as this release removes support for that version.
The takeaway
Users should prioritize upgrading to version 13.0.0 to avoid the high-severity command injection flaw identified in previous iterations. Monitor official Linux distribution security trackers for backported patches if your environment cannot support the move to the latest version immediately.
Further reading
Stay updated on the latest software supply chain vulnerabilities at Cybersecurity.
Source note: This article includes information reported by ESecurityPlanet.
Live Poll
Do you trust that current software updates are sufficient to protect your digital data?
