# Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

**URL:** <https://forums.thehomestack.io/t/critical-flaw-in-python-s-popular-pillow-image-library-allows-code-execution-via-a-crafted-image/26581>\
**Category:** The Hacker News\
**Created:** [October 23, 2026, 10:40am UTC](https://forums.thehomestack.io/t/critical-flaw-in-python-s-popular-pillow-image-library-allows-code-execution-via-a-crafted-image/26581 "2026-10-23T10:40:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![robinhood1995](https://forums.thehomestack.io/letter_avatar_proxy/v4/letter/r/48db29/32.png) [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\
**Post date:** [October 23, 2026, 10:40am UTC](https://forums.thehomestack.io/t/critical-flaw-in-python-s-popular-pillow-image-library-allows-code-execution-via-a-crafted-image/26581/1 "2026-10-23T10:40:11Z")

</div>

Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open.

The flaw,&nbsp;CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file’s name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.

* * *
This is a companion discussion topic for the original entry at [https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html](https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html)