NewsThe Hacker News
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Linked advisories
- CVE-2026-112900Pillow: heap buffer overflow in FlashPix (FPX) JPEG decoding lets one crafted image run code (CVE-2026-112398)
- CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
- CVE-2026-112900Python-pillow Pillow: Betriebssystem-Befehlsinjektion
- CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
- CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
- CVE-2026-112900Python-pillow Pillow: Betriebssystem-Befehlsinjektion
Affected vendors and products
More on Execution
Other advisories
- CriticalCVE-2026-114053vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
- CriticalCVE-2026-114053vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
- CriticalCVE-2026-110858GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
- Highghsa:GHSA-f9j4-qggq-h239GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
- Not ratedCVE-2026-78845Remote Code Execution (RCE) (CVE-2026-78845)
- MediumCVE-2026-114608Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
- CriticalCVE-2026-35002Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
- CriticalCVE-2026-35002Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
Other news entries
- HPE Patches Dozens of Critical Flaws in Networking ProductsNewsSecurityWeek
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code ExecutionNewsThe Hacker News
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution FlawNewsThe Hacker News
- Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python PackagesNewsSecurityWeek
- PHP shares mitigation for new RCE vulnerability with no patchNewsBleepingComputer
- HPE patches eight max severity RCE and auth bypass AOS flawsNewsBleepingComputer
- PHP2Shell exploit bypasses protections designed to stop remote code executionNewsThe Register — Security
- GitLab critical patches include one for a bug that allows code execution by unauthenticated usersNewsCSO Online
Source: https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html
ID