CVE-2026-55798
MediumCVSS 4.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In Pillow prior to version 12.3.0, the WindowsViewer.get_command() function constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands.
Risk Assessment
An attacker can exploit this vulnerability to achieve remote code execution on Windows if they can supply a malicious file path to the WindowsViewer.get_command() function, potentially leading to full system compromise.
Recommendation
Immediately upgrade Pillow to version 12.3.0 or later, which fixes the command injection vulnerability.
Original NVD description (English source)
Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.