Pillow CVE-2026-112900 is fixed in Pillow 13.0.0, released October 16, 2026. The CVE was rated 9.2 (Critical) by the CVE Numbering Authority (CNA). Upgrade Pillow to 13.0.0 or later, as the fixed version and related advisories are described in the source.
WHO AND WHAT THE VULNERABILITY AFFECTS
Pillow is a widely used Python image library that often sits deep in dependency trees—pulled in by web frameworks, thumbnailing services, or ML toolkits. The vulnerability relates to an argument injection in Ghostscript when Pillow renders EPS images, via how a filename reaches Ghostscript.
MITIGATION AND DETECTION YOU CAN APPLY NOW
Upgrade to Pillow 13.0.0 or later. If your Pillow comes from a distribution package, check the distribution’s tracker, and use PyPI installation in a virtual environment or container if needed until the fix is available in the distribution.
Dependency scanning reports the Pillow version in your lockfiles, including transitive dependencies.
Use dependency scanning to report Pillow versions in lockfiles, container scanning to identify Ghostscript as an OS package, and code search to locate Pillow usage and Ghostscript references.
REMEDIATION AT SCALE WITH GITLAB TOOLING
Locate Pillow usage across GitLab groups, then patch first the projects that also use Ghostscript or handle EPS content. Use Orbit to map dependencies and open findings across groups. Use Duo Agent Platform to create a scalable workflow for upgrading Pillow to 13.0.0 in affected projects, complemented by merge request-based reviews and image testing.
CONTEXT, UNCERTAINTY, AND WHAT REMAINS TO BE WATCHED
No exploitation in the wild has been reported as of the cited date; CVE-2026-112900 is described as automatable by some trackers. Distribution trackers vary in status, and administrators should verify fixes against their distro trackers while also validating image processing behavior after upgrade, since Pillow 13.0.0 changes some behaviors (e.g., TIFF tags handling, I-mode PNG saving).
WHAT HAPPENS NEXT FOR TEAMS
Upgrade to 13.0.0 across Python projects that depend on Pillow. Rebuild affected container images and redeploy to ensure the fixed release resolves dependencies. Validate image-processing tests to catch any behavioral changes introduced in 13.0.0 before production rollout.
RELATED COVERAGE
- Governed, agentic code review on GitLab Duo Agent Platform: what the verified evidence says about feasibility, cost, and governance
- What the verified evidence says about GitLab’s Recommend Reviewers Flow
- GitLab MCP server GA: Connecting external agents to your software lifecycle
- GitLab arms developers with cost controls for AI agents via Duo Agent Platform and Orbit
- Developer Tools articles
SOURCES
- GitLab: Pillow CVE-2026-112900: How to find and fix it with GitLab Published · Primary source
