| Package | Affected versions | Patched versions |
|---|---|---|
| pillow | < 9.0.0< 9.0.1 | 9.0.09.0.1 |
| pillow | < 9.0.1 | 9.0.1 |
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method ImageMath.eval("exec(exit())").
While Pillow 9.0.0 restricted top-level builtins available to PIL.ImageMath.eval(), it did not prevent builtins available to lambda expressions. These are now also restricted in 9.0.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free