CVE-2026-55798: Pillow Windows Command Injection Vulnerability (CVSS 4.5)

Technical summary

CVE-2026-55798 is an OS command injection vulnerability (CWE-78) in Pillow's WindowsViewer.get_command() function. The vulnerable code embeds a file path directly into an f-string without shell escaping, then passes the constructed command to subprocess.Popen() with shell=True. This allows cmd.exe metacharacters in the file path to break out of the quoted context and execute arbitrary commands. The attack vector is local, requires user interaction (opening an image), and succeeds only under specific conditions (high complexity: file must be opened via Pillow's image viewer on Windows). The severity is rated MEDIUM (CVSS 4.5) with impacts on confidentiality, integrity, and availability limited to the user's session context.

Business impact

Organizations and developers relying on Pillow for image processing face risk if they deploy applications that accept user-supplied image files and open them using Pillow's default viewer on Windows systems. A compromised image filename could lead to execution of malware, lateral movement within a network, or data exfiltration. The impact is typically scoped to the user account running the Python process, but in scenarios where applications run with elevated privileges or process images from untrusted sources (web uploads, cloud storage), the business consequences could include unauthorized system access or compromise of sensitive data. The requirement for user interaction limits the attack surface compared to network-facing vulnerabilities.

Affected systems

Pillow versions prior to 12.3.0 are affected. The vulnerability is specific to Windows environments where the image viewer functionality is invoked. Python applications using Pillow to handle image files on Windows systems are at risk, particularly those that: (1) process images with user-controlled or untrusted filenames, (2) open images programmatically using Pillow's viewer, or (3) run with elevated privileges. Linux and macOS systems are not affected due to differences in command construction for those platforms.

Exploitability

Exploitation requires local system access and user interaction—specifically, the target user must open a specially-crafted image file via Pillow's viewer. The attack cannot be triggered remotely or without user action. However, the technical bar for exploitation is relatively low: an attacker need only craft a filename containing standard shell metacharacters (e.g., `image.jpg & malicious.exe`) and convince a user to open it. This could occur through file sharing, email attachments, or shared repositories. No authentication or special privileges are required to create or distribute a malicious filename. The CVSS complexity rating (High) reflects the user interaction requirement and the local-only nature of the attack.

Remediation

Upgrade Pillow to version 12.3.0 or later. This version fixes the command injection by properly escaping file paths before passing them to the shell. For organizations unable to immediately upgrade, reduce risk by: (1) restricting the use of Pillow's image viewer on Windows systems where feasible, (2) using alternative image viewers or handling image display through other libraries, (3) implementing file naming policies to prevent metacharacters in image filenames, and (4) running Python applications with minimal necessary privileges rather than as administrator.

Patch guidance

Pillow 12.3.0 and all subsequent versions contain the fix. Verify the installed version using `pip show pillow` and upgrade via `pip install --upgrade pillow`. Organizations using Pillow as a dependency should update their requirements.txt or lock files to specify version 12.3.0 or later. If Pillow is vendored or pinned to a specific version, remove the pin and allow automatic patching, or explicitly update to 12.3.0+. Test the patched version in a development environment against any custom image-handling workflows before deploying to production.

Detection guidance

Monitor for attempts to open image files with suspicious filenames containing shell metacharacters (ampersands, pipes, semicolons, backticks, etc.). In application logs, look for subprocess execution originating from Pillow's viewer process on Windows systems, particularly unexpected child processes launched from Python interpreters. File access logs may show creation or modification of image files with unusual naming patterns. On Windows, enable Windows Defender Application Guard or AppLocker rules to restrict execution of unexpected processes spawned from Python applications. Network behavior monitoring is less useful since the attack is local, but endpoint detection and response (EDR) tools should alert on unexpected process spawning from Pillow operations.

Why prioritize this

This vulnerability merits timely attention but does not require emergency response. The CVSS score of 4.5 (MEDIUM) and the requirement for local user interaction limit the immediate threat scope. However, organizations should prioritize patching if they: (1) operate web applications that accept user-uploaded images and process them on Windows backend servers, (2) deploy Pillow-dependent tools on multi-user systems where untrusted users can interact with image files, or (3) use Pillow in automated workflows that might consume images from untrusted sources. Standard patch cycles (30–60 days) are acceptable for most environments, but teams managing public-facing image processing should expedite to 2–4 weeks.

Risk score, explained

The CVSS 3.1 score of 4.5 reflects a local attack vector with high complexity (user interaction and conditional exploitation), limited scope, and moderate impact (partial confidentiality, integrity, and availability). The score appropriately captures that this is not a critical, easily-exploitable flaw; however, the vulnerability is not negligible because command injection on Windows can have serious consequences if the conditions are met. The lack of CVSS Environmental or Temporal modifiers means organizations should adjust their internal risk rating based on whether they store/process untrusted image files and the privilege level at which Pillow runs.

Frequently asked questions