Summary
Pillow's EPS processing can pass a caller-controlled filename to Ghostscript in a way that allows the filename to be interpreted as a Ghostscript option. An attacker who controls the filename, and in the command-execution scenario also controls a referenced argument file, may achieve arbitrary command execution when the EPS input is processed.
Pillow's EPS processing can pass a caller-controlled filename to Ghostscript in a way that allows the filename to be interpreted as a Ghostscript option. An attacker who controls the filename, and in the command-execution scenario also controls a referenced argument file, may achieve arbitrary command execution when the EPS input is processed.
Affected context
The issue affects Pillow deployments that process EPS images through EpsImagePlugin.Ghostscript and pass filenames influenced by an attacker or another untrusted source. It is relevant when the supplied filename begins with a hyphen and is forwarded to Ghostscript without being converted into a safe absolute path or otherwise separated from command-line options. The full command-execution chain additionally depends on an attacker-controlled @ argument-file reference and control of the referenced text file.
The issue affects Pillow deployments that process EPS images through EpsImagePlugin.Ghostscript and pass filenames influenced by an attacker or another untrusted source. It is relevant when the supplied filename begins with a hyphen and is forwarded to Ghostscript without being converted into a safe absolute path or otherwise separated from command-line options. The full command-execution chain additionally depends on an attacker-controlled @ argument-file reference and control of the referenced text file.
Exploit preconditions
- Attack surface: EPS image processing through Pillow and its Ghostscript integration
- Required access: Ability to control or influence the input filename; arbitrary command execution additionally requires control of a referenced Ghostscript argument file
- Trigger point: Invocation of Ghostscript while Pillow processes the EPS input
- Why exploitation is possible: The filename is placed after
-fwithout reliable option termination or safe path normalization, allowing a hyphen-prefixed name to be interpreted as a Ghostscript argument
- Attack surface: EPS image processing through Pillow and its Ghostscript integration
- Required access: Ability to control or influence the input filename; arbitrary command execution additionally requires control of a referenced Ghostscript argument file
- Trigger point: Invocation of Ghostscript while Pillow processes the EPS input
- Why exploitation is possible: The filename is placed after
-fwithout reliable option termination or safe path normalization, allowing a hyphen-prefixed name to be interpreted as a Ghostscript argument
Why this happens
The vulnerable pattern passes caller-controlled filename data into a command-line interface without ensuring that the value is treated strictly as a file operand. A filename beginning with a hyphen can therefore alter Ghostscript's argument parsing, which maps to CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'). In the reported command-execution chain, an injected @ argument causes Ghostscript to read additional options from an attacker-controlled text file, linking the issue to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
The vulnerable pattern passes caller-controlled filename data into a command-line interface without ensuring that the value is treated strictly as a file operand. A filename beginning with a hyphen can therefore alter Ghostscript's argument parsing, which maps to CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'). In the reported command-execution chain, an injected @ argument causes Ghostscript to read additional options from an attacker-controlled text file, linking the issue to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Potential impact
- An attacker may alter Ghostscript processing options.
- Arbitrary commands could execute in the application process context when the required argument-file conditions are met.
- Sensitive files or imaging-service data could be exposed or modified.
- The host or service account could be compromised.
- Downstream image-processing workflows may be disrupted or used for lateral movement.
- An attacker may alter Ghostscript processing options.
- Arbitrary commands could execute in the application process context when the required argument-file conditions are met.
- Sensitive files or imaging-service data could be exposed or modified.
- The host or service account could be compromised.
- Downstream image-processing workflows may be disrupted or used for lateral movement.
General mitigation guidance
Mitigation generally focuses on ensuring that data-derived filenames cannot be interpreted as command-line options.
Common defensive patterns include:
- Passing validated, canonical absolute paths to subprocess interfaces.
- Using argument-vector APIs rather than shell command construction.
- Applying explicit option termination where supported and treating filenames strictly as operands.
- Restricting EPS processing and avoiding attacker-controlled filenames or argument files where possible.
- Running Ghostscript and image-processing workers with least privilege and suitable filesystem, network, and process isolation.
- Applying allowlists for supported image formats and enforcing resource and execution policies for untrusted documents.
Mitigation generally focuses on ensuring that data-derived filenames cannot be interpreted as command-line options.
Common defensive patterns include:
- Passing validated, canonical absolute paths to subprocess interfaces.
- Using argument-vector APIs rather than shell command construction.
- Applying explicit option termination where supported and treating filenames strictly as operands.
- Restricting EPS processing and avoiding attacker-controlled filenames or argument files where possible.
- Running Ghostscript and image-processing workers with least privilege and suitable filesystem, network, and process isolation.
- Applying allowlists for supported image formats and enforcing resource and execution policies for untrusted documents.
How teams detect issues like this
Organizations can detect related risks through:
- Static analysis rules for subprocess calls that combine user-controlled filenames with command arguments.
- Code review checks for missing option termination, path canonicalization, or operand validation.
- Tests using filenames beginning with hyphens and other option-like forms to verify they remain data.
- Runtime monitoring for unexpected Ghostscript arguments,
@argument-file usage, or child-process creation during image conversion. - Policy enforcement that restricts EPS processing, Ghostscript capabilities, and execution privileges in isolated workers.
- Automated security review tools that identify command and argument injection patterns.
Organizations can detect related risks through:
- Static analysis rules for subprocess calls that combine user-controlled filenames with command arguments.
- Code review checks for missing option termination, path canonicalization, or operand validation.
- Tests using filenames beginning with hyphens and other option-like forms to verify they remain data.
- Runtime monitoring for unexpected Ghostscript arguments,
@argument-file usage, or child-process creation during image conversion. - Policy enforcement that restricts EPS processing, Ghostscript capabilities, and execution privileges in isolated workers.
- Automated security review tools that identify command and argument injection patterns.
