CVE-2026-55798: Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
WindowsViewer.get_command() constructs a cmd.exe shell command by directly embedding a
file path into an f-string without escaping. The result is passed to
subprocess.Popen(..., shell=True). Shell metacharacters in the file path — most
importantly a double-quote (") that breaks out of the wrapping, followed by & — allow
injection of arbitrary cmd.exe commands.
The macOS equivalent (MacViewer) correctly applies shlex.quote() to the same parameter.
The Linux equivalent (UnixViewer) does likewise. Windows is the only platform missing this
protection, despite shlex.quote being already imported on line 21 of ImageShow.py.
References
- github.com/advisories/GHSA-4x4j-2g7c-83w6
- github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2257.yaml
- github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
- github.com/python-pillow/Pillow/commit/8404ea5fe5df40fc34aa1e51403dd6fce0778b8a
- github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4
- github.com/python-pillow/Pillow/commit/b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f
- github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6
- nvd.nist.gov/vuln/detail/CVE-2026-55798
Code Behaviors & Features
Detect and mitigate CVE-2026-55798 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →