CVE-2023-50447: Arbitrary Code Execution in Pillow

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-19 · updated 2026-06-17
Weakness: CWE-94

Description

Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).

Affected products

Debian Linux: 10.0
python-pillow Pillow: through 10.1.0
Pypi Pillow: before 10.2.0; 1.0, 1.1, 1.2, 1.3, 1.4, 1.5 (+89) — fixed in 10.2.0

How to fix

Upgrade to a fixed version: Pypi Pillow 10.2.0. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2024/01/20/1
https://devhub.checkmarx.com/cve-details/CVE-2023-50447/
https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/
https://github.com/python-pillow/Pillow/releases
https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html
http://www.openwall.com/lists/oss-security/2024/01/20/1
https://devhub.checkmarx.com/cve-details/CVE-2023-50447/
https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/
https://github.com/python-pillow/Pillow/releases
https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html

Get alerted when CVE-2023-50447 or the next vulnerability affects your stack