## Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

- 種別: news
- 重大度: critical
- 関連技術: python
- CVE: CVE-2026-112900
- 公開日時: 2026-10-23T09:36:00.000Z
- 情報源: The Hacker News (https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html)
- パーマリンク: https://vulnpulse.app/items/thehackernews-e21e419ebac5

Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.