Количество 5
Количество 5
CVE-2026-55798
Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.
CVE-2026-55798
Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.
CVE-2026-55798
Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.
CVE-2026-55798
Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get ...
GHSA-4x4j-2g7c-83w6
Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-55798 Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0. | CVSS3: 4.5 | 0% Низкий | 29 дней назад |
 | CVE-2026-55798 Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0. | CVSS3: 4.5 | 0% Низкий | 29 дней назад |
 | CVE-2026-55798 Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0. | CVSS3: 4.5 | 0% Низкий | 29 дней назад |
| CVE-2026-55798 Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get ... | CVSS3: 4.5 | 0% Низкий | 29 дней назад |
| GHSA-4x4j-2g7c-83w6 Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path | CVSS3: 4.5 | 0% Низкий | 15 дней назад |
Уязвимостей на страницу