CVE-2026-55798

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-55798
Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

4.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst Release Notes
https://github.com/python-pillow/Pillow/commit/8404ea5fe5df40fc34aa1e51403dd6fce0778b8a Patch
https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4 Patch
https://github.com/python-pillow/Pillow/commit/b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f Patch
https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6 Exploit Vendor Advisory
https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*
History

07 Jul 2026, 18:58

Type Values Removed Values Added
References () https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst - () https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst - Release Notes
References () https://github.com/python-pillow/Pillow/commit/8404ea5fe5df40fc34aa1e51403dd6fce0778b8a - () https://github.com/python-pillow/Pillow/commit/8404ea5fe5df40fc34aa1e51403dd6fce0778b8a - Patch
References () https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4 - () https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4 - Patch
References () https://github.com/python-pillow/Pillow/commit/b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f - () https://github.com/python-pillow/Pillow/commit/b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f - Patch
References () https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6 - () https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6 - Exploit, Vendor Advisory
First Time Python
Python pillow
CPE cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*

07 Jul 2026, 16:16

Type Values Removed Values Added
References () https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6 - () https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6 -

06 Jul 2026, 19:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-07-06 19:17

Updated : 2026-07-07 18:58

NVD link : CVE-2026-55798

Mitre link : CVE-2026-55798

CVE.ORG link : CVE-2026-55798

JSON object : View

Products Affected

python

  • pillow
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')