Critical Pillow Flaw Lets Malicious EPS Files Execute Commands on Python Servers

A newly disclosed vulnerability in Pillow, the most widely adopted image-processing library for Python, can enable an attacker to run arbitrary operating‑system commands on a server simply by providing a crafted EPS (Encapsulated PostScript) image.

Pillow is embedded in countless Python applications, from web frameworks and content‑management systems to data‑science notebooks, making it a common point of contact for user‑supplied images. The flaw, catalogued as CVE‑2026‑112900, stems from the way the library opens EPS files: it forwards the supplied filename directly to the underlying system call without sufficient sanitisation.

When an EPS file is opened, Pillow constructs a command line that includes the image's pathname. By embedding shell metacharacters or a full command sequence in the filename itself, an attacker can cause the operating system to execute that code before the image is even parsed. Because the vulnerability is triggered at the file‑opening stage, it bypasses any later checks that might validate the image's contents.

Servers that automatically process uploaded images—such as social‑media platforms, e‑commerce sites, or automated thumbnail generators—are especially exposed. A malicious user could upload a seemingly innocuous EPS file, and if the application passes the file to Pillow without restriction, the attacker’s payload would run with the privileges of the hosting process, potentially compromising the entire system.

The issue was first reported by The Hacker News, and the CVE identifier has been assigned. Pillow’s maintainers have acknowledged the problem and issued a security advisory urging users to apply the forthcoming patch or temporarily disable EPS handling. Recommended mitigations include updating to the patched version as soon as it is released, configuring the library to reject EPS files from untrusted sources, and employing sandboxing techniques for any image‑processing workloads.

This vulnerability highlights a broader challenge for developers who rely on third‑party libraries to handle complex file formats. EPS files can contain embedded PostScript commands, and many image libraries historically treat them as raw data rather than as executable content. Past incidents involving similar libraries have shown that insufficient input validation can open a path to remote code execution.

As the Python community prepares to roll out the fix, security‑focused organisations are advised to audit their image‑handling pipelines, enforce strict file‑type whitelists, and monitor for any unexpected command execution. Ongoing vigilance will be crucial to prevent exploitation of this flaw before the patch is widely adopted.