External risk intelligence

Pillow Argument Injection Vulnerability Leading to Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-112900

Pillow is a library integrated into various applications rather than a standalone network service. While it can be used by public-facing web applications to process user-uploaded images, the vulnerability is not exposed by default and requires the application to specifically process EPS files using the affected plugin in a way that incorporates user-controlled input.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Pillow, a Python imaging library, has a vulnerability that could allow attackers to inject commands by manipulating filenames when processing EPS files. This issue arises from how the library passes filenames to Ghostscript, potentially enabling arbitrary command execution if specific conditions are met. The main concern is to confirm if your organization uses Pillow to process EPS files and if those files are sourced from untrusted inputs.

Image processing library has a command injection risk.
High-impact risk if EPS files are processed.
Verify EPS file processing and external input.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by controlling the filename of an EPS image processed by an application using Pillow. If the application doesn't properly sanitize this filename, it can be passed to Ghostscript in a way that injects malicious commands. This could potentially lead to arbitrary command execution on the server, especially if the attacker can also control an argument file.

Entry condition: Attacker controls EPS filename.
Trigger point: Pillow processes EPS with controlled filename.
Resulting risk: Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect systems processing EPS image files using specific versions of the Pillow Python library. When a specially crafted filename is provided, it could lead to the execution of arbitrary commands on the underlying system.

System commands may be executed.
Via crafted EPS filenames processed by Pillow.
Arbitrary command execution on the host.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts applications utilizing the Pillow Python imaging library for EPS file processing. The first actionable step is to identify all instances of Pillow across your environment, focusing on those that process EPS files and are exposed to user-controlled input. Confirming the business criticality of these instances and identifying their accountable owners is crucial before planning remediation, which may involve vendor coordination for updates or implementing compensating controls if immediate patching is not feasible.

Application owners and platform teams.
Verify EPS processing and user input exposure.
Plan updates or implement compensating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Pillow in the context of CVE-2026-112900?

Pillow is a widely used Python imaging library designed to add image processing capabilities to applications. Developers use it to open, manipulate, and save many different image file formats. This vulnerability specifically concerns the library's ability to handle Encapsulated PostScript (EPS) files by communicating with an external software component called Ghostscript.

How does this argument injection vulnerability work?

This is an argument injection flaw (CWE-88) that can lead to command execution (CWE-78). When Pillow processes an EPS file, it sends the filename to Ghostscript. If the filename is not properly sanitized, an attacker can provide a name starting with a hyphen. Ghostscript might interpret this as a configuration option rather than a filename, allowing the attacker to inject malicious commands or flags into the command line.

Does any EPS file trigger this bug?

No. Simply processing an EPS file is not enough to trigger the vulnerability. The issue requires the attacker to control the filename string passed to the library. Furthermore, achieving arbitrary command execution is a multi-step process that specifically requires the attacker to also control a separate, referenced text file containing malicious Ghostscript arguments.

Is my system at risk if I use Pillow?

Halo Surface Signal notes that while Pillow is a library used in many applications, it is not a standalone network service. You are primarily at risk if your application processes EPS files sourced from untrusted user inputs. If your software does not handle EPS uploads or uses a different processing method, the attack surface for this specific vulnerability is significantly reduced.

What is the first step to address this CVE?

You should audit your environment to locate applications that utilize the Pillow library. Prioritize identifying instances where your software accepts and processes EPS files provided by external or untrusted users. Once these specific workflows are mapped, you can coordinate with your development teams to update to version 13.0.0 or implement necessary security controls to sanitize inputs.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.