{"id":"thehackernews-e21e419ebac5","seq":460510,"kind":"news","title":"Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image","url":"https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html","permalink":"https://vulnpulse.app/items/thehackernews-e21e419ebac5","summary":"Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.","severity":"critical","techs":["python"],"cves":["CVE-2026-112900"],"tags":["security"],"source":{"id":"thehackernews","name":"The Hacker News"},"published_at":"2026-10-23T09:36:00.000Z","fetched_at":"2026-10-23T10:22:54.898Z"}