CVE-2026-55798

Published: Jul 6, 2026Modified: Jul 7, 2026

4.5

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Exploitability: 1.0 / Impact: 3.4

Source: security-advisories@github.com (Secondary)

Description

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

Affected (1)

Products: Python: Pillow

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Python Pillow	Before 12.3.0

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (6)

https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst

Source: security-advisories@github.com

Release Notes

https://github.com/python-pillow/Pillow/commit/8404ea5fe5df40fc34aa1e51403dd6fce0778b8a

Source: security-advisories@github.com

Patch

https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4

Source: security-advisories@github.com

Patch

https://github.com/python-pillow/Pillow/commit/b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f

Source: security-advisories@github.com

Patch

https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.