Security Advisory

CVE-2026-55798

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-06 18:44:38

Last updated 2026-07-07 15:19:40

Assigner GitHub_M

CVSS score 4.5

State PUBLISHED

Description

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

← Browse all CVEs View on cve.org ↗