CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-50447
High (8.1). EPSS 1.7% chance of exploitation in the next 30 days. Fixed in pillow 10.2.0.
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-94, CWE-95
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- python:pillow
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3f63-hfp8-52jq | PyPI | pillow | <10.2.0 | 10.2.0 |
| PYSEC-2026-457 | PyPI | pillow | <10.2.0 | 10.2.0 |