Update Pillow to the latest patched version (version 10.0.1 or later, or the appropriate fix for your current release series). Implement strict input validation for all uploaded images, particularly EPS files. Sanitize and validate filenames before passing them to external processes. Consider restricting execution privileges of applications that process user-uploaded images. Monitor security advisories from the Python Software Foundation and Pillow Team for any subsequent updates.
Quick answers
What is CVE-2026-112900?
Update Pillow to the latest patched version (version 10.0.1 or later, or the appropriate fix for your current release series). Implement strict input validation for all uploaded images, particularly EPS files. Sanitize and validate filenames before passing them to external processes. Consider restricting execution privileges of applications that process user-uploaded images. Monitor security advisories from the Python Software Foundation and Pillow Team for any subsequent updates.
How severe is CVE-2026-112900?
critical, CVSS 9.8
Is CVE-2026-112900 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-112900 be mitigated?
Update Pillow to the latest patched version (version 10.0.1 or later, or the appropriate fix for your current release series). Implement strict input validation for all uploaded images, particularly EPS files. Sanitize and validate filenames before passing them to external processes. Consider restricting execution privileges of applications that process user-uploaded images. Monitor security advisories from the Python Software Foundation and Pillow Team for any subsequent updates.
CVSS
9.8
Vendor
Python Software Foundation
Published
Oct 24, 2026 · 05:33
Patch
Unknown / not confirmed
Affected products
Pillow, Ghostscript
Mitigation
Update Pillow to the latest patched version (version 10.0.1 or later, or the appropriate fix for your current release series). Implement strict input validation for all uploaded images, particularly EPS files. Sanitize and validate filenames before passing them to external processes. Consider restricting execution privileges of applications that process user-uploaded images. Monitor security advisories from the Python Software Foundation and Pillow Team for any subsequent updates.
A critical vulnerability (CVE-2026-112900) in the Python Pillow image processing library has been disclosed. The flaw stems from insufficient sanitization of filenames when handling Encapsulated PostScript (EPS) images. Pillow passes the filename to Ghostscript for rendering without validation, enabling attackers to inject and execute arbitrary operating system commands. The vulnerability affects widely deployed web frameworks, content management systems, and any application processing user-uploaded or external EPS images. Patches have been released; immediate updating is strongly recommended.
