vulnerability
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
HighCVSS 9.2
Summary
Specifically, an attacker can control the filename passed to Image.open(), potentially leading to remote code execution on servers where Ghostscript is installed. Version 13.0.0 of Pillow addresses this issue, and users are advised to upgrade immediately. The vulnerability affects versions 2.6.0 through 12.3.0.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data