Critical Flaw in Pythons Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow the most widely used image library for Python can be made to run operating system commands on a server by specifying the name of a file it is told to open The flaw CVE2026112900 is in the way Pillow handles EPS images which it opens by passing the files name to Ghostscript a separate program it runs to turn the image into pixels without checking the name first