Critical 9.2Published Oct 19, 2026

CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Updated under an hour ago (Oct 27, 2026, 5:10 PM ET)

Does this affect you?

It affects python-pillow Pillow and 1 other product. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.43%, higher than 36% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for python-pillow Pillow

Exploited in the last 30 days

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading @ argument-file filename and control of the referenced text file containing additional Ghostscript arguments; the reported chain reproduces with the default -dSAFER invocation. This issue is fixed in version 13.0.0.

CVSS: 9.2 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-78, CWE-88
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.43% (percentile 36)
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Oct 20, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

python-pillow Pillow python_pillow:pillow (from the name)	from 2.6.0, < 13.0.0	CNA record
python pillow python:pillow	from 2.6.0 before 13.0.0	NVD

References

References

https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh	x-refsource-confirm, exploit, mitigation, vendor-advisory
https://github.com/python-pillow/Pillow/commit/a2c363141da31a265dd536c945677db4b64f3ec9	x-refsource-misc, patch
https://github.com/python-pillow/Pillow/releases/tag/13.0.0	x-refsource-misc, release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.