{"id":"CVE-2023-50447","aliases":["GHSA-3f63-hfp8-52jq","BIT-pillow-2023-50447","PYSEC-2026-457"],"title":"Arbitrary Code Execution in Pillow","summary":"Arbitrary Code Execution in Pillow","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"pillow","product":"pillow","ecosystem":"pip","affected":["pillow < 10.2.0"],"patched":["pillow 10.2.0"],"published":"2024-01-19","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:04.766695102Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-3f63-hfp8-52jq","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50447"},{"url":"https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc87b160a"},{"url":"https://devhub.checkmarx.com/cve-details/CVE-2023-50447"},{"url":"https://duartecsantos.github.io/2023-01-02-CVE-2023-50447"},{"url":"https://duartecsantos.github.io/2024-01-02-CVE-2023-50447"},{"url":"https://github.com/python-pillow/Pillow"},{"url":"https://github.com/python-pillow/Pillow/releases"},{"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html"},{"url":"https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security"},{"url":"http://www.openwall.com/lists/oss-security/2024/01/20/1"}],"tags":["osv","pip"],"epss":0.01703,"epssPercentile":0.76234,"ingestedAt":"2026-09-12T03:13:01.646Z","slug":"CVE-2023-50447","body":"## Overview\n\nPillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).\n\n## Affected packages\n\n- `pillow < 10.2.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pillow 10.2.0`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}