What is the CVSS score of CVE-2026-55798?

CVE-2026-55798 has a CVSS 3.1 base score of 4.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-55798?

Yes, a public proof-of-concept exploit is available for CVE-2026-55798. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-55798?

Yes, a patch is available for CVE-2026-55798. Update the affected software to the latest version immediately.

Pillow CVE-2026-55798

EUVD-2026-41898 MEDIUM

OS Command Injection (CWE-78)

2026-07-06 GitHub_M

GHSA-4x4j-2g7c-83w6 PYSEC-2026-2257

Command Injection Python Pillow Red Hat

4.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.5 MEDIUM

AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

vuln.today AI

4.5 MEDIUM

Local vector and high complexity reflect that attacker-controlled filename must reach the Windows-only viewer code path; no system privileges required but user must trigger viewing.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

4.0 AV:L/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Red Hat

4.5 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jul 06, 2026 - 20:02 EUVD

Analysis Generated

Jul 06, 2026 - 19:41 vuln.today

CVE Published

Jul 06, 2026 - 18:44 cve.org

MEDIUM 4.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

91,642 pypi packages depend on pillow (19,947 direct, 73,219 indirect)

Ecosystem-wide dependent count for version 12.3.0.

DescriptionCVE.org

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

AnalysisAI

Command injection in Pillow's WindowsViewer component (all versions prior to 12.3.0) allows arbitrary cmd.exe command execution when a user opens an image with a crafted filename containing shell metacharacters. The root cause is in WindowsViewer.get_command(), which embeds an unsanitized file path directly into an f-string and passes the result to subprocess.Popen with shell=True on Windows. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Pillow (python-pillow/Pillow) is the dominant Python imaging library, forked from PIL. The affected component, WindowsViewer.get_command(), is Windows-specific and invokes cmd.exe to open images using the native Windows viewer. The vulnerability stems from unsafe use of Python's subprocess.Popen with shell=True combined with f-string interpolation of an attacker-influenced file path - a textbook instance of CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Characters such as &, |, and ; are not escaped or sanitized, allowing them to be interpreted by cmd.exe as command separators or chain operators. The CPE cpe:2.3:a:python-pillow:pillow:*:*:*:*:*:*:*:* covers all pre-12.3.0 versions across platforms, though exploitation is limited to Windows deployments that invoke this viewer code path.

RemediationAI

Upgrade Pillow to version 12.3.0 or later, which addresses this vulnerability via three commits: 8404ea5fe5df40fc34aa1e51403dd6fce0778b8a, 88194166691b7b603529b8b036ab3ab9cedd2de4, and b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f, as confirmed by the vendor advisory at https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6. If upgrading immediately is not possible, the most effective workaround is to avoid invoking WindowsViewer.get_command() with any file path derived from untrusted input - for example, by sanitizing filenames to strip or reject shell metacharacters before they reach this code path; note that blocklist-based sanitization carries inherent bypass risk and should be considered a temporary measure only. Applications on Linux or macOS are not affected and require no action.