Neutron, our AI engine, scored 97.1% on UC Berkeley's CyberGym benchmark. Learn more

Tag

#argument injection

1 articles

Deep Dive

Pillow Ghostscript Argument Injection RCE (CVE-2026-112900)

Pillow 2.6.0 to 12.3.0 passes an attacker-controlled EPS or PostScript filename to Ghostscript unsanitized, allowing argument injection and command execution; fixed in 13.0.0.

Ostorlab Team
Oct 26, 2026