Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.
| CVE | CVE-2026-112900 |
|---|---|
| 정보원 | The Hacker News |
| 수집 시각 | 2026. 10. 23. 오후 07:22 |
| 데이터 | Markdown JSON |
2026. 10. 23. 오후 06:36, The Hacker News에서 "Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image"을(를) 게시했습니다 (유형: 보안 뉴스). 심각도는 "긴급"(critical)입니다. 관련 기술: Python. CVE: CVE-2026-112900.