A critical 12-year-old RCE flaw in Pillow, Python's most popular imaging library, let attackers inject commands through filenames passed to Ghostscript. CVSS 4.0 score: 9.2. Fixed in https://deafnews.it/en/article/pillow-1300-fixes-rce-the-filename-not-the-file-was-the-threat
DeafNewsPillow 13.0.0 Fixes RCE: The Filename, Not the File, Was the Threat | DeafNewsA critical argument-injection flaw in Pillow, the most popular Python imaging library with nearly 436 million monthly PyPI downloads, allowed remote code execution via attacker-controlled filenames passed to Ghostscript. The vulnerability persisted for roughly twelve years and is fixed in version 13.0.0, released October 16, 2026, with a CVSS 4.0 score of 9.2.