Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.

The Hacker Newsで読む

2026/10/23 18:36、The Hacker Newsが「Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image」を公開しました (種別: セキュリティニュース)。重大度は「緊急」(critical) です。関連する技術: Python。CVE: CVE-2026-112900。