CVE-2026-112900

Affected versions of the Pillow package are vulnerable to OS Command Injection due to insufficient sanitization of the input filename used when invoking Ghostscript. The `PIL.EpsImagePlugin.Ghostscript()` function assigns the attacker-controllable `fp.name` directly to the `infile` variable, which is then passed unmodified to the `-f` option of the Ghostscript command list executed via `subprocess.check_call()`, allowing a filename beginning with `-`, `--`, or `@` to be interpreted by Ghostscript as a command-line option or argument file rather than a plain filename. An attacker who can control the filename passed to `Image.open()`, such as through a file-upload feature that preserves user-supplied names, can craft a filename like `@arg` referencing a malicious argument file to inject additional Ghostscript parameters (for example `-sOutputFile=%pipe%/bin/id`), resulting in arbitrary command execution on the host even with Pillow's default `-dSAFER` sandboxing enabled.