Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2022-22817: Pillow image library can run malicious code
CVE-2022-22817 · published today
Summary
The Pillow package used for handling images may execute harmful code if it processes a specially crafted picture. This risk affects any system that uses Pillow, such as Python projects or Debian installations. Update Pillow to the latest released version to eliminate the danger.
What to do
- Update jeffrey 'alex' clark pillow to version 9.0.1.
- Update debian pillow to version 9.0.0-1.
- Update pillow to version 8.0.1+aikido.1.
- Update pillow to version 8.1.2+aikido.1.
- Update python pillow to version 9.0.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | jeffrey 'alex' clark | pillow |
< 9.0.1 Fix: upgrade to 9.0.1
|
| – | python | pillow |
< 9.0.1 cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
9.0 10.0 11.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Debian:12 | debian | pillow |
< 9.0.0-1 Fix: upgrade to 9.0.0-1
|
| Root:PyPI | – | pillow |
< 8.0.1+aikido.1 < 8.1.2+aikido.1 Fix: upgrade to 8.0.1+aikido.1
|
Original advisory text
CVE-2022-22817 in pillow - Patched by Root
Root has patched CVE-2022-22817 in the pillow package for Root:PyPI. Multiple fixed versions available.
References
- https://github.com/python-pillow/Pillow/commit/8531b01d6cdf0b70f256f93092caa2a5d...
- https://github.com/advisories/GHSA-8vj2-vxx3-667w
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2022-10.y...
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtin... URL
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22817... Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-22817 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-22817 Vendor Advisory
- https://security.gentoo.org/glsa/202211-10 Vendor Advisory
- https://www.debian.org/security/2022/dsa-5053 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-74Injection
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen6 Mar 2026
Sources
GHSA-8vj2-vxx3-667w · GHSA
CVE-2022-22817 · NVD
CVE-2022-22817 · OSV
DEBIAN-CVE-2022-22817 · OSV
Track software like this
Free during beta