CVE-2026-55798: Python Pillow

Medium severity, CVSS 4.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

Affected products

• Python Pillow: before 12.3.0 (fixed in 12.3.0)

Published 2026-07-06. Last modified 2026-07-07.