Security notice

Python site that takes image uploads? Flaws in the Pillow image library can let a crafted file run code on your server. Upgrade now.

Last updated: Sunday, October 25, 2026, 8:12 AM ETStatus: Fix released. No attacks reported. Upgrade now.

On October 16, 2026, the team behind Pillow, the most widely used image library for Python, released version 13.0.0, a large security release. It fixes flaws that researchers showed can let a single crafted image, or a file name chosen by an attacker, run commands on the server that opens it. Pillow sits behind upload forms, avatars, thumbnails and document pipelines on many Python websites, and security firm OX Security estimates it is downloaded about 436 million times a month. None of the flaws is known to be under attack. If your website or web app is built with Python and accepts images or documents, ask your developer today whether it runs Pillow 13.0.0.

What happened

A big security release. Pillow 13.0.0 lists dozens of security fixes, from low to critical. The maintainers put two in their top "critical" tier. (Pillow release notes, The Hacker News)
Critical: stale image memory reused (CVE-2026-96639). When a file has several frames, Pillow could keep memory sized for one frame and write a bigger frame into it. The researcher who reported it says they ran a harmless test command on a test upload service with one crafted image upload and no login, and that this depends on the server setup. GitHub's CVE record scores it 9.8 out of 10. It affects Pillow 11.0.0 through 12.3.0. (GitHub advisory, CVE record)
Critical: JPEG decoder overflows (CVE-2026-112398 and CVE-2026-112403). In the first, the researcher's advisory says opening one crafted FlashPix file with Image.open() ran an attacker-chosen command, as long as the optional olefile package is installed. Pillow spots these files by their content, not their name, so a server that opens untrusted uploads can be hit with no user action. The second overflows memory when a program makes a thumbnail of a crafted JPEG. Its advisory reports a crash, not code execution. (CVE-2026-112398, CVE-2026-112403, The Hacker News)
The file name flaw (CVE-2026-112900). Pillow opens EPS images by handing the file's name to Ghostscript, a separate program, without checking the name first. "The flaw is triggered by the filename, not by anything in the PostScript document," the advisory says. A name chosen by an attacker can turn into commands on the server. It only matters on servers with Ghostscript (the gs program) installed, and the realistic target is upload forms that keep or build a stored file's name from what the user sent. It affects Pillow 2.6.0 through 12.3.0. (The Hacker News, CVE record)
The ratings disagree. GitHub's CVE record scores the file name flaw 9.2 out of 10, critical. Pillow's maintainers rate it medium, because the attacker has to control the file name. The Hacker News notes that the 9.2 scores depend on conditions the score does not show. (Pillow release notes, CVE record, The Hacker News)
A TIFF flaw dating back to 2013 (CVE-2026-112393). Pillow can overflow memory when it saves a TIFF image to memory, for example io.BytesIO, instead of to a file on disk. That is a common pattern for services that re-encode an upload and send it back. The reporters crashed the process with it, and say they turned it into code execution only with help from a second, separate flaw. Saving to a real file on disk is not affected. (CVE record, The Hacker News)
Test code exists. In the CVE records, CISA's analysts mark a proof of concept for the TIFF flaw and both JPEG flaws, and no known attacks for the file name flaw. We do not link to any of it. (CVE-2026-112393, CVE-2026-112900)
No attacks reported yet. The Hacker News reports that none of the flaws is known to be under attack. (The Hacker News)

Who should worry

Any server that opens images or documents from the public with an older Pillow. A crafted file that runs code on your server can let an attacker read your data, change your site or plant code that hides from you.

Python websites and web apps, such as ones built with Django or Flask, that accept image uploads, make avatars or thumbnails, or turn documents and PDFs into images. (The Hacker News)
Any copy of Pillow older than 13.0.0. Every flaw above affects Pillow 12.3.0, and the TIFF flaw goes back to Pillow 2.0.0. (Pillow release notes, CVE records)
Sites where Pillow came in without anyone choosing it. Many Python tools pull it in on their own, and older copies can sit inside containers, wheels and base images.
A developer, agency or host runs a Python site or app for you or for your clients.

What to do now

Do these today.

Ask the question. Send the message below to your developer, agency or host. You need a clear yes or no: does our site or app use Pillow, and is every copy on 13.0.0 or newer?
Upgrade to Pillow 13.0.0. It fixes all of the flaws above. Rebuild any containers, wheels or base images that bundle an older copy. (The Hacker News, Pillow release notes)
Check your Python version. Pillow 13 drops Python 3.10, so sites still on 3.10 also need Python 3.11 or newer. (Pillow release notes, The Hacker News)
Until you can upgrade, close the known paths. See Technical steps. (The Hacker News)
If the answer is "I don't know", that is not a no. Ask them to check.

What to send your developer, agency or host

Pillow 13.0.0 (released October 16, 2026) fixes dozens of security flaws, including CVE-2026-96639 (critical, CVSS 9.8, stale image storage, Pillow 11.0.0 to 12.3.0), CVE-2026-112398 and CVE-2026-112403 (JPEG decoder overflows; the FlashPix one ran a command from a single Image.open() when olefile is installed), CVE-2026-112900 (EPS file name injection into Ghostscript, Pillow 2.6.0 to 12.3.0) and CVE-2026-112393 (TIFF overflow when saving to io.BytesIO). No attacks have been reported. Please confirm today whether our site or app uses Pillow anywhere, including inside containers and base images, and that every copy is on 13.0.0 or newer (pip install -U "Pillow>=13.0.0"; needs Python 3.11 or newer). Sources: Pillow 13.0.0 release notes, The Hacker News.

Technical steps

Step 1. Check your Pillow and Python versions

python -m pip show Pillow
python --version

Run these in the same environment your site uses, and inside each container image. Anything below 13.0.0 needs the upgrade.

Step 2. Upgrade and rebuild

pip install -U "Pillow>=13.0.0"

Pin Pillow>=13.0.0 in your requirements or lock file, then rebuild and redeploy containers, wheels and base images that bundle an older copy. Pillow 13 needs Python 3.11 or newer. (The Hacker News, Pillow release notes)

Step 3. Until you can upgrade

The Hacker News, citing Pillow's security guidance and the advisories, lists steps that cut each path:

EPS and Ghostscript: keep the gs program off any server that processes untrusted uploads, and never pass a file name the user controls to Image.open() for EPS.
JPEG thumbnails: avoid draft() and thumbnail() on untrusted JPEGs, or call load() first, or pass reducing_gap=None.
TIFF: treat saving a user's TIFF to an in-memory buffer such as io.BytesIO as a sensitive path.

(The Hacker News, CVE-2026-112403)

These steps do not cover every flaw, including the critical CVE-2026-96639. Upgrading is the fix.

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. None of these flaws is known to be under attack. It means serious flaws have a fix, and servers running older Pillow are exposed until it is installed. (The Hacker News)

Can EverThread tell me if I am affected?

No. EverThread checks your website from the outside, the way a browser sees it. We do not test for these Pillow flaws, and our scan cannot see which Python libraries or versions your site runs. Your developer or host can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

One score says 9.2 and Pillow says medium. Which is right?

Both describe the same file name flaw. GitHub's 9.2 measures how bad it is when an attacker can set the file name. Pillow's maintainers rate it medium because that is a precondition. If your site keeps or builds file names from what users send and has Ghostscript installed, treat it as serious. Either way, the fix is the same: upgrade. (Pillow release notes, CVE record, The Hacker News)

Where can I follow official updates?

Pillow's 13.0.0 release notes list every fix with its advisory. The official CVE records are at CVE-2026-96639, CVE-2026-112398, CVE-2026-112403, CVE-2026-112900 and CVE-2026-112393.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

Pillow: 13.0.0 release notes (2026-10-16), Security section, checked October 25, 2026
Pillow on GitHub: Multi-frame loaders can reuse stale native image storage after mode transitions (GHSA-v9pv-5gc8-w2m6, CVE-2026-96639), October 17, 2026
CVE Program: CVE-2026-96639, CVE-2026-112398, CVE-2026-112403, CVE-2026-112900, CVE-2026-112393, checked October 25, 2026
The Hacker News: Critical Flaw in Python's Popular Pillow Image Library Allows Code Execution via a Crafted Image, October 23, 2026