Security2 hOctober 23, 2026, 16:36

Critical Pillow flaw lets crafted EPS image execute code on servers

Pillow, the most widely used Python image library, has a flaw tracked as CVE-2026-112900: when opening EPS images it passes the filename to Ghostscript without validation, allowing OS command execution. Pillow is the most common image library in Python.

The Hacker News

Open source

Critical Pillow flaw lets crafted EPS image execute code on servers

CVE-2026-112900 affects EPS image handling in Pillow
Filename is passed to Ghostscript unchecked, enabling RCE
Pillow is the most widely used Python image library

#Pillow#Python#Ghostscript

Critical Ghostscript flaw lets attackers hijack servers via PDF uploads

Canva releases its first image generation model, Canva Craft

Security

MCP Python SDK OAuth flaw lets malicious servers steal client secrets

Security

Critical Pillow flaw lets crafted EPS image execute code on servers

Critical Ghostscript flaw lets attackers hijack servers via PDF uploads

Canva releases its first image generation model, Canva Craft

MCP Python SDK OAuth flaw lets malicious servers steal client secrets

Unsloth Studio flaw let malicious AI models run Python code on inspection