Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

A flaw in Pillow, the most widely used image library for Python, can let an attacker run operating system commands on a server through a crafted EPS image, The Hacker News reports. Tracked as CVE-2026-112900, the flaw lies in how Pillow passes an EPS file’s name to the Ghostscript program it uses to render the image, without checking the name first.