CVE-2026-55798

What it actually does

Pillow versions before 12.3.0 on Windows build a shell command in WindowsViewer.get_command() by inserting an image file path directly into a cmd.exe command string and executing it with subprocess.Popen(..., shell=True). If an attacker can influence the path or filename of an image that is later opened through Pillow’s Windows image viewer functionality, cmd.exe metacharacters such as &, |, &&, ||, >, <, ^, %, or ! can break out of the intended file-open command and execute additional commands with the privileges of the Python process. The vulnerability requires user interaction or an application workflow that opens attacker-controlled image files via the affected viewer path, and it is limited by the permissions of the invoking process.

Why it matters to the business

Successful exploitation can allow an attacker-supplied image filename or path to run unintended Windows commands on a workstation, developer system, build worker, automation host, or desktop application using Pillow. The likely consequences are limited but meaningful: local data exposure, file modification, malware staging, credential theft from the current user context, or disruption of the affected process. The CVSS score is moderate and EPSS is currently low, and it is not listed in CISA KEV; however, public exploit availability increases practical risk for organizations that process untrusted image files on Windows or use Pillow in desktop/automation workflows. Pillow is a widely used Python imaging dependency, so the issue may be present indirectly through applications that bundle or depend on it.

How an attack unfolds

An attacker prepares an image with a Windows path or filename containing cmd.exe metacharacters and an appended command, then causes the target user or application to open that image using Pillow’s Windows viewer functionality, such as code paths that call Image.show() or otherwise invoke WindowsViewer.get_command(). In vulnerable versions, Pillow interpolates the path into an f-string without sufficient quoting or escaping and passes the resulting command to subprocess.Popen with shell=True. cmd.exe interprets the metacharacters as command separators or redirection operators rather than as literal filename characters, causing the attacker’s appended command to execute. The command runs under the same account and integrity level as the Python process, enabling follow-on actions such as downloading a payload, writing files, running PowerShell, collecting local data, or establishing persistence if the user context permits it.

How to fix it

Upgrade Pillow to version 12.3.0 or later in all Python environments, packaged applications, virtual environments, containers, workstation builds, and application bundles that may run on Windows. Rebuild and redeploy applications that vendor or freeze Python dependencies, including PyInstaller, cx_Freeze, embedded Python, desktop apps, notebooks, and internal tooling. If immediate upgrade is not possible, avoid invoking Pillow’s Windows viewer on untrusted files, disable or remove workflows that call Image.show() for attacker-controlled content, sanitize and reject filenames containing Windows shell metacharacters, and ensure subprocess calls do not use shell=True with untrusted input. Treat filename filtering as a temporary mitigation only; the durable fix is to consume the patched Pillow release.

How to confirm the fix worked

Confirm the installed Pillow version is 12.3.0 or later in every relevant runtime using package inventories, lockfiles, software composition analysis, or commands such as python -m pip show Pillow and python -c "import PIL; print(PIL.__version__)". Review application dependency files such as requirements.txt, pyproject.toml, poetry.lock, Pipfile.lock, conda environment files, and bundled application manifests to ensure they resolve to a fixed version. On Windows systems, verify that applications using Pillow no longer spawn cmd.exe through the vulnerable viewer path when opening image files with shell metacharacters in the filename. For mitigation validation, test that untrusted filenames containing &, |, &&, ||, >, <, ^, %, or ! are rejected or safely handled and do not result in additional child processes such as powershell.exe, cmd.exe, curl.exe, certutil.exe, mshta.exe, or rundll32.exe.

Typical attack path

1. Identify a Windows application, script, notebook, automation job, or desktop workflow that uses Pillow before version 12.3.0 and opens image files with Pillow’s Windows viewer functionality.
2. Craft or deliver an image whose filename or path includes cmd.exe metacharacters and an appended command payload.
3. Convince a user to open the file, or place the file where an automated process will invoke the affected Pillow viewer code.
4. The vulnerable WindowsViewer.get_command() function constructs a cmd.exe command containing the unescaped path and launches it with shell=True.
5. cmd.exe parses the malicious path as shell syntax and executes the attacker-controlled command in the context of the Python process.
6. The attacker performs post-exploitation actions such as payload download, local file access, command execution, or persistence depending on available privileges.

How to detect it

To determine whether exploitation already occurred, review Windows endpoint detection and process creation logs for Python interpreters or Python-packaged applications spawning cmd.exe with command lines containing image file paths and shell metacharacters. Relevant sources include Microsoft Defender for Endpoint device process events, Sysmon Event ID 1, Windows Security Event ID 4688 with command-line logging enabled, EDR process trees, PowerShell logs, application logs from image-processing tools, and file creation telemetry in user download, temp, and working directories. Focus on parent-child chains where python.exe, pythonw.exe, or a bundled application launches cmd.exe, followed by suspicious children such as powershell.exe, curl.exe, certutil.exe, bitsadmin.exe, mshta.exe, wscript.exe, cscript.exe, rundll32.exe, reg.exe, schtasks.exe, or net.exe. Look for image filenames or paths containing shell separators like &, &&, |, ||, >, <, ^, %, or !, especially in Downloads, Temp, email attachment caches, browser cache directories, shared folders, and application upload/work directories. Review any outbound network connections, new executable/script files, scheduled tasks, registry run keys, or PowerShell encoded commands created by the same user and process lineage shortly after the suspicious image open event. Since payloads are attacker-controlled, absence of a single fixed IOC does not rule out exploitation; behavioral process-chain hunting is the most reliable approach.

• ParentImage=python.exe ChildImage=cmd.exe
• ParentImage=pythonw.exe ChildImage=cmd.exe
• ParentImage=python.exe ChildImage=powershell.exe
• ParentImage=pythonw.exe ChildImage=powershell.exe
• Image=cmd.exe CommandLine contains "&" and CommandLine contains ".png"
• Image=cmd.exe CommandLine contains "&" and CommandLine contains ".jpg"
• Image=cmd.exe CommandLine contains "&" and CommandLine contains ".jpeg"
• Image=cmd.exe CommandLine contains "|" and CommandLine contains ".png"
• Image=cmd.exe CommandLine contains "|" and CommandLine contains ".jpg"
• Image=cmd.exe CommandLine contains "&&"
• Image=cmd.exe CommandLine contains "||"
• Image=cmd.exe CommandLine contains "powershell"
• Image=cmd.exe CommandLine contains "certutil"
• Image=cmd.exe CommandLine contains "bitsadmin"
• Image=cmd.exe CommandLine contains "curl"
• Image=cmd.exe CommandLine contains "mshta"
• Image=cmd.exe CommandLine contains "rundll32"
• Image=cmd.exe CommandLine contains "schtasks"
• Image=cmd.exe CommandLine contains "reg add"
• CommandLine contains "-EncodedCommand"
• CommandLine contains "IEX"
• CommandLine contains "Invoke-WebRequest"
• CommandLine contains "DownloadString"

What your security team should do

• Prioritize upgrading Pillow to 12.3.0 or later across Windows endpoints, developer workstations, image-processing tools, and packaged Python applications that may open untrusted images.
• Inventory direct and transitive Pillow usage because many applications include Pillow as an indirect dependency or bundle it into executable distributions.
• Search codebases for Image.show(), PIL.ImageShow, WindowsViewer, or custom image preview logic that may open attacker-controlled files on Windows.
• Add temporary controls to block or quarantine image files with suspicious Windows shell metacharacters in filenames where users or automation may open them locally.
• Hunt endpoint telemetry for python.exe or packaged Python applications spawning cmd.exe, powershell.exe, curl.exe, certutil.exe, mshta.exe, rundll32.exe, or wscript.exe shortly after opening image files.
• Because exploit code is publicly available, treat exposed Windows workflows that open externally supplied images as higher priority even though EPSS is currently low and the issue is not in KEV.
• Rebuild frozen or vendor-bundled applications after dependency updates; updating the system Python package alone may not fix self-contained apps.