From The Hacker News
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.
Publisher-provided RSS excerpt. This is not the full article or an independently verified AEGLIX assessment.
Read the full story at The Hacker News ↗ (opens in a new tab)