{"id":"ghsa-ghsa-w889-685w-c8fh","seq":53430,"kind":"advisory","title":"Pillow: Argument Injection in Ghostscript call, potentially leading into RCE","url":"https://github.com/advisories/GHSA-w889-685w-c8fh","permalink":"https://vulnpulse.app/items/ghsa-ghsa-w889-685w-c8fh","summary":"影響: pip:Pillow >= 2.6.0, < 13.0.0 → 13.0.0\nSummary PIL.EpsImagePlugin.Ghostscript() builds the Ghostscript command line using the input file path (fp.name) without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with -dSAFER enabled). Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ Type CWE…","severity":"critical","techs":["python"],"cves":["CVE-2026-112900"],"tags":["GHSA-w889-685w-c8fh","Pillow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T19:58:44.000Z","fetched_at":"2026-10-21T20:20:51.598Z"}