Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-55798

Опубликовано: 06 июл. 2026
Источник: redhat
CVSS3: 4.5

Описание

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

A flaw was found in Pillow, a Python imaging library. The WindowsViewer.get_command() function constructed a command-line interface (CLI) shell command by directly embedding a file path without proper escaping. This allowed shell metacharacters within the file path to inject arbitrary commands into cmd.exe. An attacker could exploit this to execute unauthorized commands on the system.

Отчет

A flaw was found in Pillow, a Python imaging library. The WindowsViewer.get_command() method constructs a cmd.exe shell command by directly embedding a file path into an f-string without applying shlex.quote() or equivalent escaping. This string is then passed to subprocess.Popen with shell=True, allowing shell metacharacters in the file path to inject and execute arbitrary cmd.exe commands. The vulnerability is specific to the Windows platform; the Linux (UnixViewer) and macOS (MacViewer) equivalents already apply proper shell quoting.

Меры по смягчению последствий

This vulnerability is specific to the WindowsViewer class in Pillow, which is only invoked on Windows systems. Red Hat products ship and run on Linux, where the UnixViewer class is used instead, which properly applies shlex.quote() to file paths. The vulnerable Windows code path is not reachable on Red Hat's supported platforms. Users can upgrade to Pillow 12.3.0 or later, which adds proper escaping to the Windows code path.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Exploit Intelligenceexploit-intelligence-tech-preview/vulnerability-analysis-rhel9Not affected
Lightspeed Corelightspeed-core/lightspeed-stack-rhel9Not affected
OpenShift Lightspeedopenshift-lightspeed/lightspeed-ocp-rag-rhel9Not affected
OpenShift Lightspeedopenshift-lightspeed/lightspeed-service-api-rhel9Not affected
OpenShift Lightspeedopenshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9Not affected
Red Hat AI Inference Serverrhaii/model-opt-cuda-rhel9Not affected
Red Hat AI Inference Serverrhaiis/model-opt-cuda-rhel9Not affected
Red Hat AI Inference Serverrhaiis/vllm-cpu-rhel9Not affected
Red Hat AI Inference Serverrhaiis/vllm-cuda-rhel9Not affected
Red Hat AI Inference Serverrhaiis/vllm-neuron-rhel9Not affected

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-78
https://bugzilla.redhat.com/show_bug.cgi?id=2497462python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths

4.5 Medium

CVSS3

Связанные уязвимости

CVSS3: 4.5
ubuntu
29 дней назад

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

CVSS3: 4.5
nvd
29 дней назад

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

CVSS3: 4.5
debian
29 дней назад

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get ...

CVSS3: 4.5
github
15 дней назад

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

4.5 Medium

CVSS3