CVE-2026-55798

A flaw was found in Pillow, a Python imaging library. The WindowsViewer.get_command() function constructed a command-line interface (CLI) shell command by directly embedding a file path without proper escaping. This allowed shell metacharacters within the file path to inject arbitrary commands into cmd.exe. An attacker could exploit this to execute unauthorized commands on the system.

A flaw was found in Pillow, a Python imaging library. The WindowsViewer.get_command() method constructs a cmd.exe shell command by directly embedding a file path into an f-string without applying shlex.quote() or equivalent escaping. This string is then passed to subprocess.Popen with shell=True, allowing shell metacharacters in the file path to inject and execute arbitrary cmd.exe commands. The vulnerability is specific to the Windows platform; the Linux (UnixViewer) and macOS (MacViewer) equivalents already apply proper shell quoting.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.