Python in October 2026: Pillow 13.0.0 fixes a Ghostscript argument injection, CPython fixes tarfile and zipfile
> TL;DR: Pillow 13.0.0, released October 16, 2026, fixes CVE-2026-112900 (CVSS 9.2): an argument injection into the Ghostscript call for EPS files, which can lead to code execution. It also fixes a FlashPix heap overflow (CVE-2026-112398), a JPEG thumbnail buffer overflow and TIFF encoding memory corruption. Earlier in October, CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16 and 3.14.8 fixed several archive extraction and TLS flaws.
Pillow: the danger is in the file name
PIL.EpsImagePlugin.Ghostscript() builds the Ghostscript command line with the file path, unsanitized. A file name starting with - is read by Ghostscript as an option. To run commands, the attacker needs a name starting with @ and control of the referenced text file.
The key point: the EPS content does not need to be malicious. A perfectly benign EPS file triggers the injection if the name passed to Image.open() is attacker-influenced. Blocking suspicious EPS files therefore does not protect you.
CPython: archives and TLS
The October 1 release series fixes, among others:
Python 3.10.22 is the final 3.10 release; the branch is now end of life.
What to do now
What this means for an AI agent
An agent that receives attachments, generates thumbnails or unpacks archives to read them often relies on Pillow, tarfile and zipfile. If the file name comes from an email, a ticket or a page the agent read, the attacker controls part of the call. It is a classic injection, triggered by content the agent read.
Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Python and Django: why CVE-2025-64459 should be taken seriously
CVE-2025-64459 showed that even a trusted ORM layer can expose SQL injection risk in specific conditions. Here is why this Django flaw should be taken seriously.
PHP2Shell, Node2Shell, Pillow, LiteLLM: how October 2026's flaws reach your AI agents
An agent never runs alone: it sits on Node.js or Python, calls PHP backends, reads files and goes through a model gateway. Here is how each October flaw becomes an attack path against an agent, and what to check.
Next.js CVE-2026-75604: Unauthenticated RCE on Windows Plus an AVIF Heap Overflow — Emergency Patches from August 25
Vercel fixed two critical Next.js flaws: a path traversal exploitable without authentication when the server runs on a Windows filesystem (CVE-2026-75604, CVSS 9.0, no workaround), and a heap buffer overflow in the sharp/libheif chain triggered by a malicious AVIF image (CVSS v4 9.5). Fixes: 15.5.24 and 16.3.3. Vercel-hosted deployments are protected.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.