Finance · SaaS
GitLab is not affected by CVE-2026-112900 or the other vulnerabilities fixed in Pillow 13.0.0. GitLab products do not include the Pillow library, and our Security team has found no evidence of impact to GitLab-managed infrastructure. GitLab.com, GitLab Self-Managed, and GitLab Dedicated are not impacted.
Pillow is one of the most widely used image libraries in the Python ecosystem. It often sits several layers down in a dependency tree, pulled in by a web framework, a thumbnailing service or an ML toolkit that nobody chose it for directly. On October 16, 2026, the Pillow project released version 13.0.0, and one of its security fixes is CVE-2026-112900: an argument injection in the way Pillow calls Ghostscript to render EPS images. The CVE record, published on October 19, rates it 9.2 (Critical) on CVSS 4.0. It affects every Pillow release from 2.6.0 up to, but not including, 13.0.0. No exploitation in the wild has been reported so far, but CISA's assessment marks it as automatable with total technical impact.
Upgrade Pillow to 13.0.0 on every project and image that handles untrusted images, and remove Ghostscript from images that do not need EPS support.
This guide is for security and platform teams with Python projects on GitLab. It covers the fixed version for each distribution, how the flaw works, the other High and Critical issues fixed in the same release, how to locate affected projects with dependency scanning, container scanning, GitLab Orbit, and code search, and how to remediate at scale with GitLab Duo Agent Platform.
CVE-2026-112900 at a glance
CVE-2026-112900 is an OS command and argument injection flaw in Pillow's EPS plugin, rated Critical (CVSS 4.0 score of 9.2) by the CVE Numbering Authority (CNA). The CVE record was published on October 19, 2026.
FieldDetail
CVECVE-2026-112900
GitHub advisoryGHSA-w889-685w-c8fh
TitlePillow: Argument Injection in Ghostscript call, potentially leading into RCE
WeaknessCWE-88 (argument injection), CWE-78 (OS command injection)
CVSS 4.09.2 Critical (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H)
Affected versionsPillow >= 2.6.0 and < 13.0.0
Fixed inPillow 13.0.0
Exploitation statusNone known at the time of writing (CISA SSVC assessment dated October 20, 2026)
Upgrade Pillow to a fixed version now
Upgrade Pillow to 13.0.0 or later. The CVE record lists 13.0.0 as the only fixed version, so every older branch needs to move to it. Framework updates and input validation on image contents do not help here, because the flaw is in how the filename reaches Ghostscript.
Your Python versionWhat to do
3.11 to 3.15Upgrade with pip install --upgrade "pillow>=13.0.0", or raise the pin in your lockfile or requirements file.
If your Pillow comes from a distribution package, check the distribution's tracker first. Distribution packages keep their own version numbers, so compare against the tracker instead of pip show. Status as of October 26, 2026:
DistributionPillow package versionStatus
Debian 12 (bookworm)9.4.0-1.1+deb12u1Vulnerable, no fix yet
Debian 13 (trixie)11.1.0-5+deb13u4Vulnerable, no fix yet
Debian forky (testing)12.3.0-1Vulnerable, no fix yet
Debian sid (unstable)13.0.0-1Fixed
SUSE Linux Enterprise (Server 15 SP4 to SP7 and 16.0 to 16.2, among others) and openSUSE Leap 16.0 and 16.1python-PillowAffected, no fix listed
Amazon Linux 2023 and 2027 Previewpython-pillowPending fix
Sources: Debian, SUSE and Amazon Linux security trackers, as of October 26, 2026. Amazon Linux 2 is listed as not affected. Ubuntu lists all releases as needing evaluation, and Red Hat, Arch Linux and Oracle Linux had no record for this CVE. Alpine's tracker could not be checked.
Until your distribution ships a fix, install Pillow 13.0.0 from PyPI in a virtual environment or container, or apply the workarounds below.
Rebuild your container images. If your Dockerfile installs Pillow without pinning a patch version, rebuild it with docker build --pull --no-cache and redeploy it so the install step resolves the fixed release. Images that pin a version, such as pillow==12.3.0, need the pin changed first. Images built on top of other base images only get the fix once their maintainers update them, so check the upstream image before you rebuild.
Pillow 13.0.0 also changes a few behaviors, such as how duplicate TIFF tags are handled and how I-mode images are saved as PNG, so run your image-processing tests before you ship the upgrade.
How the vulnerability works
EPS files are PostScript programs, so Pillow shells out to Ghostscript (gs) to render them, passing the input filename right after -f with no sanitizing.
When the image object has a .name that exists on disk, Pillow used that name as-is. Ghostscript's argument parser gives two kinds of strings special meaning:
A leading - is read as an option rather than a filename, which gives an attacker argument injection (CWE-88).
A leading @ tells Ghostscript to read more command-line arguments from the named text file. If the attacker also controls that file's contents, they control additional Ghostscript arguments, which is the path toward command execution (CWE-78).
The advisory notes that this works even with -dSAFER, the sandbox flag Pillow passes by default. That flag restricts what a PostScript program can do, but it does not stop an attacker from injecting arguments into the command line itself.
How to check if you are affected
You are exposed only if all of these are true:
Pillow is below 13.0.0.
Ghostscript is installed.
Your code opens an EPS file by a filename an attacker can influence, such as an upload saved under its original name.
The image is loaded or rendered, not just opened.
Full command execution also needs the attacker to control a text file referenced with a leading @. Services that generate their own filenames or use in-memory streams are far less likely to be reachable.
If you cannot upgrade yet: save uploads under generated names, restrict formats with Image.open(f, formats=["PNG", "JPEG"]), or remove Ghostscript from images that do not need it.
It's not just one bug: Every High and Critical issue in 13.0.0
The 13.0.0 release notes list 17 High and Critical advisories (3 Critical, 14 High). Fifteen of them map to a CVE. The two that do not, GHSA-xcvg-w56q-r89m and GHSA-78g4-xqwv-q3g8, are worth watching, because tools that match only on CVE IDs would miss them.
SeverityCVEGHSAIssue
CriticalCVE-2026-96639GHSA-v9pv-5gc8-w2m6Stale native image storage reused after mode transitions
CriticalCVE-2026-112398GHSA-5x8w-8jj5-q52hHeap buffer overflow in FlashPix (FPX) JPEG decoding
CriticalCVE-2026-112403GHSA-8g5g-8vmr-9782JPEG decoder heap buffer overflow from scanlines wider than tile extents
HighCVE-2026-96644GHSA-9v9v-9qvf-h2hjWMF/EMF heap out-of-bounds read from dimension truncation
HighCVE-2026-96637GHSA-g842-9rc4-69pwSPIDER decompression bomb bypass via seek()
HighCVE-2026-96643GHSA-g4qv-2jxx-769hUnbounded Exif header replacement loop
HighCVE-2026-96778GHSA-g7cr-3p24-7wf7JPEG comment write after ICC profile fills encoder buffer
HighCVE-2026-112395GHSA-462x-pgg6-55fpTIFF tile and YCbCr decoding out-of-bounds read from undersized libtiff buffers
HighCVE-2026-112404GHSA-c6hw-5grf-ff96TIFF tile and YCbCr decoding out-of-bounds read from undersized libtiff buffers
HighCVE-2026-112895GHSA-p4wg-p73j-c528PDF parsing stack exhaustion from long trailer chains and deep or cyclic page trees
HighCVE-2026-96640GHSA-mrfp-p49p-3hf2PDF append resource exhaustion from repeated page tree references
HighCVE-2026-112896GHSA-pchr-8j38-3x4pTIFF encoder accepted an incorrectly sized Colormap for non-8-bit images
HighCVE-2026-112393GHSA-332p-7hrc-92wfTIFF encoder heap buffer overflow when saving to a file object
HighNo CVE found yetGHSA-xcvg-w56q-r89mTIFF encoder heap buffer overflow when tags override the image size
HighCVE-2026-112902GHSA-xvh5-g6gv-559vTIFF encoder memory disclosure and crash from mismatched tag values
HighCVE-2026-112897GHSA-q45j-58j2-45rgTIFF decoding returned uninitialized memory for short JPEG strips
HighNo CVE (GitHub: "No known CVE")GHSA-78g4-xqwv-q3g8Bundled OpenJPEG heap buffer overflow when reading tile-part data
Locate Pillow across your GitLab groups
Find every project that installs Pillow, then fix first the ones that also have Ghostscript and accept uploads.
Dependency scanning reports the Pillow version in your lockfiles, including transitive dependencies. Turn it on per project, or for a whole group with a scan execution policy. Merge request approval policies can block merges that add a vulnerable version, and continuous vulnerability scanning re-checks existing projects when an advisory is published, for advisories up to 14 days old.
Container scanning finds Ghostscript installed as an OS package. Images with Pillow but no Ghostscript cannot render EPS files, so they are lower priority. It misses Ghostscript compiled from source. Turn container scanning on the same way.
GitLab Orbit: Because Pillow tends to arrive as someone else's dependency, asking "who uses it?" is hard from any single project. GitLab Orbit turns your projects, pipelines, security findings and code into a graph that an agent can query. Enable it on the top-level group, then ask for the Python projects that handle images and for the projects with open findings on CVE-2026-112900 or the other Pillow advisories. This will give you a shortlist before you open a single repository.
Orbit covers only the default branch and is in beta for Premium and Ultimate on GitLab.com and GitLab Self-Managed. It doesn't parse Dockerfiles yet, so confirm Ghostscript with the code search in the next step.
Code search finds what scanners miss. Run these in exact code search at the top-level group with regular expression mode on:
file:requirements.*\.txt$ (?i)^\s*pillow
lang:Dockerfile (?i)ghostscript
(?i)EpsImagePlugin|\.eps\b
Finally, compare the results with what actually runs. Anything running that your projects do not declare is a gap. For Kubernetes, operational container scanning covers the images in your clusters.
Remediate at scale with GitLab Duo Agent Platform
Once you have the list of affected projects, the remaining work is repetitive: raise a version, open a merge request, get it reviewed. Hand the repetitive part to agents and keep people on the decisions.
Start in Agentic Chat and ask it to list the Dependency Scanning findings for these Pillow CVEs from the Vulnerability Report (Ultimate), then create an epic with one issue per affected project. Assigning an issue to the Developer Flow produces a merge request that raises Pillow to 13.0.0 or later, or edits the version pinned in the Dockerfile. A flow trigger on the Assign event starts the flow as soon as the issue is assigned. The Code Review Flow can then give each merge request a first review against your review instructions.
The agents stop at the merge request. A person still has to review and merge each one, run the image-processing tests because 13.0.0 changes how duplicate TIFF tags and I-mode PNG saves behave, and confirm the fixed version is deployed before closing the issue.
Timeline
DateWhat happened
October 16Pillow releases 13.0.0 with fixes for 38 security entries. The release notes list the EPS Ghostscript issue as GHSA-w889-685w-c8fh with no CVE yet.
October 19GitHub, as CNA, reserves and publishes CVE-2026-112900 with a CVSS 4.0 score of 9.2 (Critical). CVE-2026-112393 and CVE-2026-112403, the TIFF writer and JPEG decoder heap overflows, are published the same day.
October 20CISA's coordinator adds an SSVC assessment for CVE-2026-112900: exploitation none, automatable yes, technical impact total.
October 23Debian lists only its unstable release (13.0.0-1) as fixed. Ubuntu lists all releases as needing evaluation.
Sources
Pillow 13.0.0 release notes
CVE-2026-112900 record and GHSA-w889-685w-c8fh
Fix commit a2c3631
Debian security tracker and Ubuntu security tracker, as of October 23, 2026
GitLab: Dependency scanning using SBOM
GitLab: Continuous dependency scanning
GitLab: Container scanning and exact code search
Oct 26 · 00:00·GitLab