Pillow 13.0.0 fixes critical flaws incl. EPS/Ghostscript command execution (CVE-2026-112900), JPEG and TIFF memory bugs
Pillow, the most widely used Python image library (about 436 million downloads a month, per OX Security), shipped version 13.0.0 on October 16 with a large security release. It fixes flaws across all severity levels, two of them rated critical by the maintainers. The headline issue, CVE-2026-112900, lets an attacker who controls the filen…