[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRrCakgSeLi5ze1cIoPpZGAMuBH4rjE-3ks-W_c7VKQk":3},{"article":4,"iocs":55,"watch_terms":66,"solutions":67,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4b223527-323d-42d8-bc40-3d4e83c6700f","Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image","critical-flaw-in-python-s-popular-pillow-image-library-allows-code-execution-via-e21e41","Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.","A critical vulnerability (CVE-2026-112900) in the widely used Python Pillow image library allows for operating system command execution through specially crafted EPS image filenames. The flaw, present in versions 2.6.0 through 12.3.0, is triggered when Pillow passes filenames to the Ghostscript interpreter without proper validation. Pillow maintainers have released version 13.0.0 to address this and other critical security issues.","Critical code execution flaw in Python's Pillow library affects versions 2.6.0 to 12.3.0.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fcritical-flaw-in-pythons-popular-pillow.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgGp9s38cCmrESabSZezAPkJaYoavpBM8Ehckei0ZrhKfBSoSXMyrWkzooakGExz1GBYVgi0izvW8wyKH2CEX7vpzLExRkK7uNW8wDdMzJ_k7NR8u6q-WA9e8Aoc19LNfJbFKgB6GkbAKbXW69_lOdM4sz4t5fmpKsLxHWKJPOugq5g_45Q5_WmCm_vA6U\u002Fs1600\u002Fpython-image.jpg","2026-10-23T09:36:00+00:00","2026-10-23T12:00:12.307381+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"Pillow","product",{"name":21,"type":22},"Python","technology",{"name":24,"type":22},"EPS images",{"name":26,"type":19},"Ghostscript",{"name":28,"type":19},"Claude",{"name":30,"type":31},"Anthropic","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[56,60,63],{"type":57,"value":58,"context":59},"cve","CVE-2026-112900","Critical code execution vulnerability in Pillow's EPS image handling.",{"type":57,"value":61,"context":62},"CVE-2026-112403","JPEG decoding overflow flaw in Pillow's FlashPix (FPX) format.",{"type":57,"value":64,"context":65},"CVE-2026-112393","TIFF image saving memory buffer overflow vulnerability in Pillow.",[30,18,26],{"controls":68,"vendors":152},[69,98,123],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":99,"name":100,"problem":101,"products":102},"patch-management","Automated patch management","Known holes get closed in days, not months.",[103,111,115],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":99,"product_name":112,"url":113,"description":114},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":124,"name":125,"problem":126,"products":127},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[],{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"critical-pillow-library-flaw-enables-os-command-execution-via-crafted-images","Critical Pillow Library Flaw Enables OS Command Execution via Crafted Images","A critical vulnerability in Python's Pillow image library (CVE-2026-112900) allowed attackers to execute arbitrary operating system commands by passing specially crafted EPS image filenames to the Ghostscript interpreter without proper input validation. The flaw affected a decade's worth of releases (versions 2.6.0 through 12.3.0), meaning countless applications built on Pillow were silently exposed. This matters because Pillow is a foundational dependency used across web applications, data pipelines, and machine learning workflows, making the blast radius exceptionally large. The fix — upgrading to version 13.0.0 — was available, yet any organization without a mature dependency-tracking and patching process would remain vulnerable.",[158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","PCI DSS Requirement 6","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":166,"PCI DSS Requirement 6":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"OWASP A06:2021 Vulnerable and Outdated Components":169,"CIS Control 7: Continuous Vulnerability Management":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 requires entities to implement policies on vulnerability handling and disclosure; operators relying on Pillow without a process to track upstream CVEs and apply patches would be in breach of this obligation.","Requirement 6 mandates that organizations develop and maintain secure systems by protecting them against known vulnerabilities, including keeping third-party libraries patched to current versions.","SI-2 requires organizations to identify, report, and correct software flaws in a timely manner; a formal flaw remediation process would have ensured Pillow 13.0.0 was deployed promptly after the advisory was published.","This incident is a textbook example of A06 — a widely used third-party library with a known critical CVE remaining in production because dependency versions were not continuously monitored and updated.","Regular, automated scanning of application dependencies would have flagged the vulnerable Pillow versions and triggered remediation before attackers could exploit the flaw.","This control explicitly requires timely identification and patching of technical vulnerabilities in software components, directly addressing the failure to track and upgrade the affected Pillow versions.","While primarily an input-validation flaw, limiting which processes and users can invoke Ghostscript would have constrained the impact of successful exploitation by reducing attacker-accessible execution pathways."]