CVE-2022-22817

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 9.0.1

Description The issue allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used, potentially enabling a remote attacker to execute arbitrary code in the system by passing a specially crafted file to the vulnerable library.

Recommendations For Pillow versions prior to 9.0.0, update to version 9.0.1 to resolve the issue. For Pillow version 9.0.0, update to version 9.0.1 to fully restrict builtins available to lambda expressions and prevent exploitation.