Pillow EPS Handling Flaw Enables Ghostscript Argument Injection, PoC Shows Path to RCE

What happened

A GitHub Security Advisory (GHSA-w889-685w-c8fh) reports an argument injection vulnerability in Pillow's PIL.EpsImagePlugin.Ghostscript() function, now tracked as CVE-2026-112900. According to the advisory, Pillow builds the Ghostscript command line using the input file's path (fp.name) without sanitizing it, placing the value directly after a -f flag. A filename starting with - is interpreted by Ghostscript as an option rather than a file, enabling argument injection (CWE-88). The researcher further reports that a filename of the form @<path> triggers Ghostscript's argument-file syntax, allowing multiple injected arguments at once — and includes a proof-of-concept chaining this into command execution (CWE-78) via Ghostscript's output-device pipe feature. The advisory states this reproduces on Pillow 12.3.0 with Ghostscript 10.02.1 and 10.07.1, and that Pillow's default -dSAFER flag does not prevent it. The reporter characterizes the affected code as long-standing and likely present across current Pillow versions, including main.

Why it matters for defenders

Pillow is an extremely widely used Python imaging library, and EPS rendering depends on an external Ghostscript binary — a common configuration in environments that process document or image uploads. The reported risk hinges on an attacker influencing the filename passed to Image.open(), not the file's content, which the advisory notes is a realistic precondition for applications such as upload endpoints that preserve or derive stored filenames from user-supplied data. Where that precondition holds, the advisory's PoC indicates a path from argument injection to arbitrary command execution on the host running Pillow.

What defenders should watch for now

• Inventory services that call Pillow's EPS/PostScript handling (Image.open() on .eps files) with any Ghostscript dependency, especially where filenames are user-influenced (uploads, extracted archive contents, forwarded attachments).
• Review whether uploaded or user-derived filenames are ever used as-is on disk versus renamed/normalized by the application before being handed to Pillow.
• At a detection level, consider monitoring for Ghostscript (gs) child processes spawned from Python/Pillow-hosting services with anomalous command-line arguments — particularly filenames beginning with - or @, or Ghostscript invocations referencing %pipe% output devices.
• As a mitigation per the advisory's suggested fix, ensure any file path reaching Ghostscript is normalized to an absolute path (e.g., os.path.abspath()) before use, since this prevents a leading - or @ from being reinterpreted as an option or argument-file token.
• Track upstream Pillow guidance and patches closely, since no fixed version is confirmed in the advisory at the time of writing.

Developing situation

This is a same-day disclosure based on a GitHub Security Advisory with a public proof-of-concept; no CVSS score has been assigned yet and a patched Pillow release has not been confirmed in the advisory text. Treat details as preliminary and consult the original source as the authoritative record: GHSA-w889-685w-c8fh.