Pillow EPS Ghostscript argument injection (CVE-2026-112900)

The flaw sits in how Pillow, the Python imaging library, opens EPS images. To render most EPS files, Pillow starts the Ghostscript program and passes it the file name after the -f option. Before the fix, the name went through as it was. Ghostscript reads a name that starts with a hyphen as an option, and a name that starts with @ as a list of more options stored in a file.

An attacker who picks the file name can therefore add Ghostscript options. The advisory says this works with Pillow's default -dSAFER setting. NVD adds two conditions for command execution (remote code execution). The name must start with @, and the attacker must control the text file it points to, which holds the extra Ghostscript arguments. The reporter's proof of concept ran the id command this way.

Several conditions must all hold, so the risk is not the same for every Python project. First, Ghostscript must be installed on the server. Without it, Pillow cannot render EPS files this way. Second, Pillow must get a path, or a file object whose name points to a file on disk. Third, an outsider must decide or influence that file name, for example through an upload feature that keeps the name it was sent with. Fourth, the file must be read as EPS and loaded, which is when Ghostscript runs.

Upwind's security team notes that code paths which never call Ghostscript are not affected. Apps that store uploads under names the server makes up, or that limit Image.open() to the formats they need, are not exposed by this bug. Pillow picks the format from the file content, not the name, so an app that expects PNG can still open EPS content unless you limit the formats. The flaw does not depend on anything inside the image, so a harmless EPS file with a bad name is enough.

Our checks on 23 October 2026 showed the following. GitHub: the reporter's proof of concept, a Dockerfile plus two short scripts, is public inside the advisory itself. Checkmarx Zero wrote on X on 20 October that "PoCs are included in public advisories".

X: 17 posts matched our searches from 19 October, and 11 of them were about this flaw. They repeat the advisory, add upgrade advice or link to news.

Dark web monitoring through THANOS: 3 posts carry the CVE id, all on Telegram, all from news and CVE feed channels, on 20 and 23 October. These are aggregate counts. We did not run or link any code.

The CISA coordinator entry from 20 October rates exploitation as "none" and the flaw as automatable with total technical impact. CISA had not listed the CVE in its Known Exploited Vulnerabilities catalog in the file released on 21 October. That can change, so treat it as a flaw to fix in your next patch cycle, not as an emergency for every Python shop. GitHub rates it critical and the Pillow maintainers rate it moderate, which fits the narrow conditions above.

Pillow is often pulled in as a dependency of other packages. It can sit in your software bill of materials (SBOM) without anyone having chosen it.

Pillow from 2.6.0 up to, but not including, 13.0.0. Pillow 13.0.0 fixes it. The reporter says the vulnerable code is long standing. The reporter tested Pillow 12.3.0 with Ghostscript 10.02.1 and also confirmed command execution with Ghostscript 10.07.1.

The fix is one change in Pillow's EPS plugin. It turns the file name into an absolute path before Ghostscript sees it, so a leading hyphen or @ can no longer be read as an option. A test in the same change opens a file named -h and checks that it loads as a normal image.

Pillow 13.0.0 drops support for Python 3.10, which reached end of life in October 2026. If a service still runs 3.10, pip will not install the fixed release there. Plan the move to a newer Python, and use the workarounds below until then.

The 13.0.0 release is a large security release. GitHub also rates other Pillow flaws fixed in 13.0.0 as critical. They include CVE-2026-112393, a heap overflow when saving a TIFF to memory, and CVE-2026-112403, a heap overflow in the JPEG decoder. A third is CVE-2026-96639, reuse of stale image storage after mode changes. One upgrade covers them all.