Arbitrary Code Execution in Pillow

ALTO 8.1CVE-2023-50447 · BIT-pillow-2023-50447 · GHSA-3f63-hfp8-52jq · Published 19/01/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`< 10.2.0`	`10.2.0`
pillow python	`≤ 10.1.0`	No fix yet

Description

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

NVD description

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

References

nvd.nist.gov/vuln/detail/CVE-2023-50447 · ADVISORY
python-pillow/Pillow commit 45c726f · WEB
devhub.checkmarx.com/cve-details/CVE-2023-50447 · WEB
duartecsantos.github.io/2023-01-02-CVE-2023-50447 · WEB
duartecsantos.github.io/2024-01-02-CVE-2023-50447 · WEB
python-pillow/Pillow · PACKAGE
python-pillow/Pillow release · WEB
lists.debian.org/debian-lts-announce/2024/01/msg00019.html · WEB
pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html · WEB
openwall.com/lists/oss-security/2024/01/20/1 · WEB
devhub.checkmarx.com/cve-details/CVE-2023-50447 · Third Party Advisory
duartecsantos.github.io/2024-01-02-CVE-2023-50447
pypi.org/project/pillow · PACKAGE
GitHub Advisory GHSA-3f63-hfp8-52jq · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free