Pillow 13.0.0 Fixes Critical RCE Flaws — Is Your Python Stack Patched?

As reported by The Hacker News, Pillow version 13.0.0 — released October 16, 2026 — addresses a batch of vulnerabilities spanning four severity levels, including two rated critical by maintainers. The most notable is CVE-2026-112900, a command-injection flaw in EPS image handling that earned a CVSS 9.2 from GitHub's CVE record. With Pillow downloaded an estimated 436 million times per month, the blast radius here is enormous, even if no active exploitation has been observed yet.

Why This Matters Beyond the CVE Score

The maintainers rate CVE-2026-112900 as moderate because exploitation requires the attacker to control the filename passed to Pillow — not the file content. But this dismisses a common real-world pattern: web applications that preserve user-supplied filenames when saving uploads. Any service that stores an uploaded file using the original client-side name, then later passes that path to Image.open(), is a viable target. The attack surface isn't the image payload — it's the filename string, and that string is frequently attacker-controlled in practice.

The flaw is triggered by the filename, not by anything in the PostScript document. A harmless EPS file can still cause damage when an attacker controls its name.

The second critical issue is a memory-reuse bug triggered after an image mode change, and the third involves JPEG decoding overflows — one of which can achieve code execution from a single Image.open() call on a crafted file, provided the optional olefile package is installed. Notably, Pillow identifies files by content magic bytes, not extension, so extension-based allowlisting on upload forms provides no protection against this vector.

Vulnerability Summary

CVE	Severity	Affected Versions	Vector	Exploitation
CVE-2026-112900	Critical (CVSS 9.2)	Pillow 2.6.0 – 12.3.0	Filename injection via Ghostscript (EPS)	Not observed in the wild
CVE-2026-112403	Critical	Pillow ≤ 12.3.0	Buffer overflow in lossless JPEG thumbnail generation	Not observed in the wild
Memory reuse bug	Critical	Pillow ≤ 12.3.0	Stale image data after mode change	Not observed in the wild
JPEG/FPX overflow	Critical	Pillow ≤ 12.3.0 (requires olefile)	Code execution via crafted file content	Not observed in the wild

Who Is Most Exposed

Web applications with image upload endpoints — especially those that retain user-supplied filenames on disk or in temporary paths before processing.

Document and PDF processing pipelines that handle EPS or JPEG inputs and pass them through Pillow for rasterization or thumbnailing.

Machine learning inference services — most ML projects transitively depend on Pillow for preprocessing, and inference endpoints often accept user-uploaded images.

Hosts with Ghostscript installed — CVE-2026-112900 only reaches Ghostscript when the gs binary is present, which is common on Linux server images that include PDF tooling.

The AI Discovery Angle

One of the JPEG overflow flaws was discovered by Anthropic using Claude to audit open-source software security, then validated manually by Ada Logics. This is a meaningful signal: AI-assisted vulnerability research is now producing real, high-severity findings in widely deployed libraries. Defenders should expect the disclosure cadence for dependencies like Pillow to accelerate as more firms deploy LLM-driven fuzzing and code audit pipelines. The implication for supply-chain security is clear — your dependency patching cycle must get faster, because the discovery side already has.

Shield53 Recommendations

Immediate Actions

Upgrade to Pillow 13.0.0 immediately. Pin the version in your requirements.txt, pyproject.toml, or container image. Verify the upgrade doesn't break image-processing workflows, as 13.0.0 is a major version bump.
Audit filename handling. Search your codebase for patterns where Image.open() receives a path constructed from user input. Replace user-supplied filenames with server-generated UUIDs or hashes before writing to disk.
Remove Ghostscript if EPS support is unnecessary. Uninstalling gs eliminates the CVE-2026-112900 attack path entirely on hosts where EPS rasterization isn't required.
Remove or isolate olefile if FlashPix format support isn't needed, closing the FPX-based code execution vector.
Scan dependencies transitively. Use tools like pip-audit, Snyk, or Dependabot to identify services pulling in vulnerable Pillow versions, including indirect dependencies through frameworks like Django, Flask, or ML libraries.

Detection Guidance

Monitor for unusual child processes spawned by Python workers — specifically gs invocations with unexpected argument patterns or pipe redirects.
Log all filenames passed to image-processing functions and alert on shell metacharacters (|, ;, &, $, backticks) in file paths.
Deploy file-content inspection (magic byte validation) in addition to extension checks on upload endpoints, recognizing that Pillow itself identifies formats by content.

Longer-Term Hardening

Run image processing in sandboxed containers with minimal installed packages and no shell access.
Implement strict file-size and dimension limits upstream of Pillow to reduce exposure to crafted-image attacks.
Establish a SLA for patching critical dependency vulnerabilities — given AI-accelerated discovery, aim for a 48-hour window from CVE publication to deployed patch in production.