An EPS file's name is passed to Ghostscript as an option

Argument injection in the Ghostscript call, potentially leading to remote code execution.

Advisory

CVE-2026-112900 (also GHSA-w889-685w-c8fh)

Library

Pillow, pillow on PyPI

Published

2026-10-21

Severity

9.2 out of 10, as published

Affected

>= 2.6.0, < 13.0.0

Fixed in

13.0.0

Reaches you

by opening a file

What triggers it

Opening an EPS (PostScript) file, recognised by content whatever its name, when Ghostscript is installed; the file's own name is read as a Ghostscript option.

What sillybos does

Refused by default

sillybos refuses the triggering file under its default policy, through the formats check.

PostScript is not one of the four formats and is refused by name from the first bytes, so no PostScript file reaches Pillow's EPS reader through the check.

Proved by this test in the sillybos suite, which builds the triggering file from bytes and checks that it is refused:

• tests/test_check.py::TestHostileFiles::test_a_renamed_postscript_file

How to protect yourself

In general. Upgrade to Pillow 13.0.0. Do not install Ghostscript on a machine that opens files from outside unless it is needed.

Specifically. Image.open(path, formats=["JPEG", "PNG", "TIFF"]) keeps the EPS reader from ever running; sillybos refuses the file before that.

The general advice applies to every row here.

Sources

• https://github.com/advisories/GHSA-w889-685w-c8fh
• The record entry, triaged 2026-11-01, last checked 2026-11-01