PT-2026-55966

CVE-2026-55798

Published

2026-07-06

Updated

2026-07-20

Description by

CVSS 3.1

4.5

Medium

MetricsAV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0

Description The WindowsViewer.get command() function constructs a cmd.exe shell command by embedding a file path into an f-string without proper escaping. This result is then passed to subprocess.Popen(..., shell=True), which allows the injection of arbitrary cmd.exe commands via shell metacharacters within the file path.

Recommendations Update to version 12.3.0.

Exploitability

Exploit

Fix

Impacts

Researchers

1121984919

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers