CVE-2026-55798

Description

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

Weakness classification

• security-advisories@github.com: CWE-78

Primary references

• security-advisories@github.com — Release Notes
• security-advisories@github.com — Patch
• security-advisories@github.com — Patch
• security-advisories@github.com — Patch
• security-advisories@github.com — Exploit, Vendor Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Vendor Advisory