CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-22817
Critical (9.8). EPSS 3.6% chance of exploitation in the next 30 days. Fixed in pillow 9.0.0, 9.0.1.
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
Severity
- EPSS
- 3.6% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- python:pillow
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8vj2-vxx3-667w | PyPI | pillow | <9.0.1 | 9.0.1 |
| PYSEC-2022-10 | PyPI | pillow | <9.0.0 | 9.0.0 |
References
- https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
- https://security.gentoo.org/glsa/202211-10