importantSYS.SOURCE: The Hacker News• 2026-10-23T15:06:00+05:30

Critical Remote Code Execution Vulnerability in Python's Pillow Library via EPS Image Handling

#vulnerability #python #security #image-processing

A critical vulnerability (CVE-2026-112900) in the Pillow Python image library allows remote code execution through improper handling of EPS images. The flaw arises from passing unverified file names to Ghostscript without validation.

Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open.

The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.

Read original article

*** END OF TRANSMISSION ***

> QUEST DIAGNOSTICS CONFIRMS CYBERATTACK LEADING TO PATIENT DATA BREACH > EMUDHRA'S PRIVATE KEY COMPROMISE OF INTERMEDIATE CERTIFICATES AND MOZILLA ROOT INVESTIGATION DEADLINE OMISSION > LARGE-SCALE CYBERATTACK EXPLOITS ENTERPRISE FIREWALLS AND VPNS, LEAKING 70,000 CREDENTIALS > INVESTOR-OWNED UTILITIES CHARGE 23% MORE FOR ELECTRICITY THAN PUBLIC PROVIDERS > SHITTER: A PRIVACY-FOCUSED NITTER FORK FOR ALTERNATIVE TWITTER ACCESS > OPENSSL 4.1.0 RELEASE: ENHANCED CRYPTOGRAPHIC FEATURES AND PLATFORM SUPPORT > AI-GENERATED WIKI OF ENRON EMAILS WITH SOURCE CITATIONS > SWEDISH GOVERNMENT OFFICES PROHIBIT USE OF CHATGPT AND CLAUDE AI MODELS > PHP IDENTIFIES UNPATCHED RCE VULNERABILITY CVE-2026-115560 AMID RECENT SECURITY UPDATES > RUSSIAN STATE-SPONSORED HACKERS EXPLOIT MESH NETWORK BACKDOOR IN UKRAINE CYBERATTACK> QUEST DIAGNOSTICS CONFIRMS CYBERATTACK LEADING TO PATIENT DATA BREACH > EMUDHRA'S PRIVATE KEY COMPROMISE OF INTERMEDIATE CERTIFICATES AND MOZILLA ROOT INVESTIGATION DEADLINE OMISSION > LARGE-SCALE CYBERATTACK EXPLOITS ENTERPRISE FIREWALLS AND VPNS, LEAKING 70,000 CREDENTIALS > INVESTOR-OWNED UTILITIES CHARGE 23% MORE FOR ELECTRICITY THAN PUBLIC PROVIDERS > SHITTER: A PRIVACY-FOCUSED NITTER FORK FOR ALTERNATIVE TWITTER ACCESS > OPENSSL 4.1.0 RELEASE: ENHANCED CRYPTOGRAPHIC FEATURES AND PLATFORM SUPPORT > AI-GENERATED WIKI OF ENRON EMAILS WITH SOURCE CITATIONS > SWEDISH GOVERNMENT OFFICES PROHIBIT USE OF CHATGPT AND CLAUDE AI MODELS > PHP IDENTIFIES UNPATCHED RCE VULNERABILITY CVE-2026-115560 AMID RECENT SECURITY UPDATES > RUSSIAN STATE-SPONSORED HACKERS EXPLOIT MESH NETWORK BACKDOOR IN UKRAINE CYBERATTACK