Pillow

Global – October 29, 2026 -- Three critical vulnerabilities rated CVSS 9.2 in Pillow, the Python imaging library with an estimated 436 million monthly downloads, let a single crafted EPS, TIFF or JPEG file trigger command execution or heap corruption in any Python service that processes user-supplied images. Disclosed on 2026-10-19, all three flaws are fixed in Pillow 13.0.0.

Pillow is a maintained fork of the original Python Imaging Library. Web frameworks such as Django and Flask, thumbnail and avatar pipelines, document and PDF tooling, and most Python machine-learning and computer-vision stacks pull it in directly or transitively. Because it routinely parses untrusted image bytes, the bugs are reachable through a plain file upload.