CVE-2026-112900pip Pillow

Not on CISA's list of exploited flaws, and not in the news we track.

Chance of exploitation in 30 daysEPSS

1.3%

0%Higher than 70% of all CVEs

Reading the vendor advisory

Fix it in one click

Fix it in your code

Explain it to me

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-112900. Nothing runs until you send it.

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Not on CISA's list of exploited flaws, and not in the news we track.

Chance of exploitation in 30 daysEPSS

1.3%

0%Higher than 70% of all CVEs

You are affected if

Anyone running Pillow 12.3.0 or earlier with Ghostscript installed, especially apps accepting user-named EPS uploads

The fix

Upgrade to Pillow 13.0.0; if impossible, remove Ghostscript or stop passing user-controlled filenames

Reading the vendor advisory

Fix it in your code

Explain it to me

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-112900. Nothing runs until you send it.

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE