A newly disclosed bug in Pillow, Python's go-to image-processing library, lets an attacker trigger operating-system command execution simply by naming a malicious file a certain way. Tracked as CVE-2026-112900, the issue stems from how Pillow hands off EPS image files to the external Ghostscript tool without sanitizing the filename first. Because Pillow sits inside countless web apps and pipelines that process user-uploaded images, the flaw could give attackers a path to remote code execution wherever untrusted EPS files are processed.
// source: thehackernews.com ↗