Pillow's Windows viewer builds a shell command from an unescaped path
Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
- Advisory
- CVE-2026-55798
- Library
- Pillow, pillow on PyPI
- Published
- Severity
- 4.5 out of 10, as published
- Affected
- < 12.3.0
- Fixed in
- 12.3.0
- Reaches you
- through another call
What triggers it
Image.show() on Windows with a file path containing shell metacharacters.
What sillybos does
Not reached by opening a file
Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.
In ImageShow, reached only when a program calls Image.show to open a desktop viewer on the machine running Python; opening a file never runs it, and a page that shows a scan in a browser serves its bytes without it. The viewer builds its shell command from the temporary file it writes, not from the scan's name, so the input is the path quoting, not the file's contents.
Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03.
How to protect yourself
In general. Upgrade to Pillow 12.3.0.
Specifically. Not a pre-decode matter: the flaw is in a call that opening a file never makes.
The general advice applies to every row here.
Sources
- https://osv.dev/vulnerability/GHSA-4x4j-2g7c-83w6
- https://osv.dev/vulnerability/PYSEC-2026-2257
- The record entry, triaged 2026-11-03, last checked 2026-11-03