Pillow 13.0.0 patches critical EPS command injection CVE-2026-112900 via safe Ghostscript path handling

Attackers exploiting this flaw gain the ability to execute arbitrary commands on systems running vulnerable versions of the Pillow library. To achieve this, they need control over the filename of an EPS file being processed and, in the case of full command execution, control over a referenced text file. The vulnerability exists in how Pillow handles input filenames when invoking Ghostscript for EPS image processing.

In plain English

When Pillow processes an Encapsulated PostScript (EPS) file, it calls an external program called Ghostscript to render the image. The flaw occurs because Pillow passes the filename directly to Ghostscript without converting it to a safe absolute path. If an attacker can control the filename, they can craft a name that starts with a hyphen. Ghostscript interprets this hyphen as the start of a command-line option, allowing the attacker to inject their own arguments into the process.

The background

This vulnerability, tracked as CVE-2026-112900, affects Pillow versions from 2.6.0 up to, but not including, 13.0.0. The National Vulnerability Database rates the issue as Critical with a CVSS score of 9.2. The weakness maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-88 (Argument Injection). The reported attack chain reproduces even when Ghostscript is invoked with the default -dSAFER flag, which is intended to restrict dangerous operations.

What changes now

The Pillow development team has released version 13.0.0 to address this security issue. This update modifies the EpsImagePlugin.Ghostscript function to convert caller-controlled input filenames into safe absolute paths before passing them to Ghostscript. This prevents filenames starting with hyphens from being misinterpreted as command-line options. Users of the Python imaging library are advised to upgrade to this version to mitigate the risk of argument injection and potential remote code execution.

What made it possible

This incident illustrates the risks of passing user-controlled data directly to external system commands. When applications invoke external utilities, they must strictly sanitize inputs to prevent argument injection. Attackers exploit this by crafting inputs that mimic command-line flags, shifting the execution context. This technique serves the initial access or privilege escalation stage of an intrusion, allowing adversaries to bypass application logic. Teams usually monitor for unusual process spawning and validate input paths rigorously to detect such anomalies early.

What to do and how to stay safe: Pillow

• Update your Pillow library to version 13.0.0 or later to apply the official fix for CVE-2026-112900.
• Audit your applications to identify any code that processes EPS files or invokes Ghostscript directly.
• Implement strict input validation for filenames, ensuring they are converted to absolute paths before use.
• Monitor system logs for unexpected Ghostscript process executions or unusual command-line arguments.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Pillow are affected by CVE-2026-112900?

All versions of Pillow from 2.6.0 up to, but not including, 13.0.0 are vulnerable to this argument injection flaw.

What is the severity rating for this vulnerability?

The National Vulnerability Database rates CVE-2026-112900 as Critical with a CVSS score of 9.2.

Does the fix require changing how Ghostscript is configured?

No, the fix is contained within Pillow version 13.0.0, which correctly handles filename paths before invoking Ghostscript.