Source: thehackernews.com
A critical vulnerability (CVE-2026-112900) has been discovered in Pillow, the most widely used Python image processing library. The flaw exists in how Pillow handles EPS (Encapsulated PostScript) image files. When opening an EPS file, Pillow passes the filename directly to Ghostscript without sanitizing or validating the input first. This behavior allows an attacker to craft a malicious filename that causes Pillow to execute arbitrary operating system commands on the server. The impact is significant given Pillow's widespread adoption across Python-based web applications and services. Exploitation could lead to remote code execution on affected servers. Users and administrators are advised to update Pillow to a patched version as soon as one becomes available.
