Critical Pillow Flaw Lets Crafted Filenames Inject Ghostscript Arguments; Version 13.0.0 Fixes It

A critical flaw in Pillow, one of the most widely used image-processing libraries in Python, can let an attacker who controls a filename inject extra arguments into the Ghostscript program that Pillow uses to render EPS images. The Pillow project fixed the bug, tracked as CVE-2026-112900, in version 13.0.0, released on October 16, 2026. The CVE record followed on October 19 with a CVSS 4.0 score of 9.2. GitLab has since published a remediation guide. It says GitLab's own products are not affected, but that many customer Python projects likely are.

What happened

The sequence of events, according to GitLab's write-up and the CVE record, is short:

• October 16, 2026: The Pillow project shipped version 13.0.0. It contained several security fixes, including the one now tracked as CVE-2026-112900.
• October 19, 2026: The CVE record was published. It classifies the bug as both argument injection (CWE-88) and OS command injection (CWE-78).
• As of October 26, 2026: Linux distributions were at very different stages of reviewing and patching the issue, based on a snapshot of their security trackers that GitLab compiled.

GitLab said its Security team found no evidence of impact on GitLab-managed infrastructure. Its products do not include Pillow, so GitLab.com, GitLab Self-Managed and GitLab Dedicated are not affected. The company's guide is aimed at security and platform teams that host Python projects on GitLab and need to find every affected codebase.

Who is affected

The vulnerable range is wide. According to the CVE description, every Pillow release from 2.6.0 up to, but not including, 13.0.0 is affected. That covers many years of releases. The CVE record lists 13.0.0 as the only fixed version, so there are no backported patches for older release branches. Every project still on an older line has to move to 13.0.0.

Many teams may not realise they use Pillow at all. GitLab points out that Pillow is often a transitive dependency, meaning a library pulled in by another library rather than chosen directly. Web frameworks, thumbnail generators and machine-learning toolkits commonly bring it in several layers down the dependency tree.

Pillow installed through a Linux distribution's package manager is a separate case, because distributions use their own version numbers. GitLab's snapshot from October 26 reported:

• Amazon Linux 2 is listed as not affected.
• Ubuntu lists all releases as still needing evaluation.
• Red Hat, Arch Linux and Oracle Linux had no record for the CVE at that point.
• Alpine's tracker could not be checked.
• Debian, SUSE and Amazon Linux trackers were consulted for package-level status. Admins should check those trackers directly for their release.

Not every Pillow user can actually be attacked this way. GitLab says a system is exposed only when all of the following are true:

• The code opens an EPS file using a filename that an attacker can influence. An upload saved under the name the user gave it is a typical example.
• The image is actually loaded or rendered, not merely opened.
• Ghostscript is installed, since that is the program Pillow calls.

Services that generate their own filenames, or that process images entirely in memory, are much less likely to be reachable.

How it works

EPS (Encapsulated PostScript) files are not simple pictures. They are small programs written in the PostScript language. Pillow cannot draw them by itself, so it hands the work to Ghostscript, an external interpreter, by launching it as a separate command.

The problem is in how Pillow builds that command. According to the CVE description, Pillow's EpsImagePlugin.Ghostscript placed the caller-supplied input filename on Ghostscript's command line without first turning it into a safe absolute path. Like many command-line tools, Ghostscript treats certain leading characters as special:

• A name that begins with a hyphen can be read as a command option rather than a file. That lets someone who controls the filename change Ghostscript's behaviour. This is the argument injection part.
• A name that begins with an @ sign tells Ghostscript to read further arguments from a text file. If an attacker can also control the contents of that file, they can supply more arguments. GitLab describes this as the route toward full command execution.

Pillow already runs Ghostscript with -dSAFER, a sandbox setting that limits what a PostScript program can do. GitLab notes that the advisory says this protection does not help here. The sandbox restricts the document being rendered, while this attack changes the command line used to launch Ghostscript in the first place. For the same reason, GitLab says framework updates and checks on image contents will not prevent the issue, because the dangerous input is the filename, not the file data.

How serious is it?

The CVE Numbering Authority rated the flaw 9.2 (Critical) on CVSS 4.0, and ITVedas's CVE database records the same score. The bug is not on CISA's Known Exploited Vulnerabilities list, and GitLab says no exploitation in the wild has been reported so far.

There are still reasons for urgency. GitLab reports that CISA's assessment marks the issue as automatable with "total technical impact." That means that where the conditions are met, attacks could be scripted at scale and the consequences could be severe.

The real-world risk depends heavily on how an application handles uploads. Argument injection needs only control of the filename. Full command execution additionally requires control over an @-referenced text file. GitLab's guide and the CVE data agree on these points, and we found no disagreements between the sources.

What to do now

For administrators and developers:

• Upgrade Pillow to 13.0.0 or later in every project and container image that handles untrusted images.
• Find hidden copies. Use dependency scanning, container scanning and code search to locate projects that pull in Pillow indirectly. GitLab's guide covers its own dependency scanning, container scanning, Orbit, code search and Duo Agent Platform for remediating many projects at once.
• Rebuild container images. If a Dockerfile installs Pillow without a pinned version, rebuild it without cached layers so it fetches the fixed release, then redeploy. If it pins an older version, update the pin first.
• Check base images. Images built on someone else's base image only get the fix once the upstream maintainer updates it.
• Check distribution trackers if Pillow comes from OS packages. Until your distribution ships a fix, install 13.0.0 from PyPI in a virtual environment or container.
• Remove Ghostscript from any image that does not need EPS support.
• Test before shipping. Version 13.0.0 changes some behaviours, including how duplicate TIFF tags are handled and how I-mode images are saved as PNG.
• If you cannot upgrade yet: save uploads under server-generated names, restrict accepted formats (for example, opening only PNG and JPEG), or remove Ghostscript.

For everyday users:

• You do not need to take direct action unless you run Python software yourself. If you do, update Pillow with your usual package tools.
• Install updates for desktop or server applications that process images when vendors release them.

What we still don't know

• GitLab says 13.0.0 also fixed other High and Critical issues. The available material does not fully describe them.
• When Ubuntu, Red Hat, Arch Linux, Oracle Linux and Alpine will publish their assessments or fixed packages.
• How many widely used frameworks or services save uploads under user-supplied names in a way that meets the exposure conditions.
• Whether proof-of-concept attacks will appear now that the details are public.

ITVedas analysis: The highest risk here is less the bug itself than how hard it is to see. Pillow is often buried several layers deep in dependency trees and container images, so teams that only check their direct dependencies may miss it. Organisations should take inventory first and patch quickly, and should remove Ghostscript from any image that does not need it.