Neutron, our AI engine, scored 97.1% on UC Berkeley's CyberGym benchmark. Learn more

Tag

#pillow

2 articles

Deep Dive

Pillow Ghostscript Argument Injection RCE (CVE-2026-112900)

Pillow 2.6.0 to 12.3.0 passes an attacker-controlled EPS or PostScript filename to Ghostscript unsanitized, allowing argument injection and command execution; fixed in 13.0.0.

Ostorlab Team
Oct 26, 2026

Deep Dive

Pillow FlashPix Heap Overflow RCE (CVE-2026-112398)

Decoding a crafted FlashPix image in Pillow 12.3.0 or older with olefile installed lets an attack...

Oct 24, 2026