{"id":"ghsa-ghsa-5hx5-vpf9-5wcv","seq":53431,"kind":"advisory","title":"pypdf: Unvalidated JPEG image data loading","url":"https://github.com/advisories/GHSA-5hx5-vpf9-5wcv","permalink":"https://vulnpulse.app/items/ghsa-ghsa-5hx5-vpf9-5wcv","summary":"影響: pip:pypdf < 6.21.1 → 6.21.1\nImpact An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called. This requires loading an image which claims to use the /DCTDecode filter (JPEG data). Users which do not have the optional Pillow dependency installed in their environment are not affected. Patches This has been fixed in [pypdf==6.21.1](https://github.com/py-pdf/pypdf/releases/tag/6.21.1). Workarounds If you cannot upgrade yet, consider applying the changes from PR [#4222](https:/…","severity":"low","techs":["python","github"],"cves":["CVE-2026-113786"],"tags":["GHSA-5hx5-vpf9-5wcv","pypdf"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T19:58:10.000Z","fetched_at":"2026-10-21T20:20:51.598Z"}