CyberRota Analysis
AI-GeneratedThe Pillow Python imaging library prior to version 12.3.0 contains a vulnerability in the WindowsViewer.get_command() function, which allows for command injection due to improper handling of file paths in shell commands. This flaw can lead to arbitrary command execution on affected Windows systems, posing a risk to applications that utilize this library. Developers and organizations using Pillow for image processing should prioritize updating to version 12.3.0 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)