Pillow CVE-2026-112900: How to find and fix it with GitLab

GitLab states that its hosted, self-managed, and dedicated products are not affected by CVE-2026-112900 because they do not include Pillow, though the critical vulnerability poses risks to Python applications that use Pillow versions 2.6.0 through 12.x alongside Ghostscript and process attacker-influenced EPS filenames. Released in Pillow 13.0.0 on October 16, 2026, the flaw can allow argument injection into Ghostscript and potentially command execution, has a CVSS 4.0 score of 9.2, and has no known exploitation in the wild despite CISA assessing it as automatable with total technical impact. Pillow 13.0.0 also resolves 17 High and Critical advisories involving image formats such as TIFF, JPEG, PDF, WMF, and OpenJPEG. Organizations are advised to upgrade Pillow to version 13.0.0 or later, rebuild and redeploy affected container images, test for behavior changes, and use generated upload filenames, restricted input formats, or Ghostscript removal as interim mitigations. Security and platform teams can identify exposure by combining GitLab dependency and container scanning, Orbit, and code search, prioritize projects that accept uploads and contain Ghostscript, and use GitLab Duo Agent Platform to assist with upgrade merge requests while retaining human review, testing, and deployment verification.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.