Pillow 13.0.0 Patches EPS Filename Injection and Three Other CVEs Affecting 436 Million Monthly Downloads

The root cause is absent sanitization of the filename argument before it is supplied to the external gs binary for EPS rasterization. A harmless PostScript payload executes arbitrary commands when the filename itself contains Ghostscript device or file directives. This vector requires no malformed image data and targets upload handlers that preserve user-supplied names. GitHub-assigned CVEs rate the EPS, TIFF save, and JPEG thumbnail issues at 9.2 while Pillow maintainers classify the filename flaw moderate and two JPEG overflows critical. CISA notes a public PoC only for the TIFF case. The pattern mirrors prior Ghostscript delegation flaws in ImageMagick and GraphicsMagick where external process invocation bypassed content validation. Widespread deployment in web frameworks, PDF pipelines, and ML training stacks means the 436 million monthly downloads translate to exposure across container images still pinned to Python 3.10. The olefile-dependent FlashPix overflow allows unauthenticated command execution on a single Image.open call, widening the attack surface beyond filename-controlled endpoints. Immediate action is pip install -U "Pillow>=13.0.0" plus rebuild of all base images; delayed upgrades leave services that accept untrusted uploads or thumbnails open to the documented attack chains.