Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2023-50447: Pillow library can let attackers execute code
CVE-2023-50447 · published today
Summary
The Python Pillow package, which many applications use to handle images, contains a flaw that could allow a malicious user to run unwanted code on your system. This risk is resolved in the latest releases of Pillow. Update the Pillow package to the newest version available for your environment to stay protected.
What to do
- Update jeffrey 'alex' clark pillow to version 10.2.0.
- Update rootio-pillow to version 9.3.0+root.io.1.
- Update jeffrey 'alex' clark pillow to version 9.3.0+aikido.1.
- Update rootio-pillow to version 9.5.0+root.io.4.
- Update rootio-pillow to version 9.5.0+root.io.7.
- Update rootio-pillow to version 9.3.0+root.io.7.
- Update rootio-pillow to version 9.3.0+root.io.9.
- Update jeffrey 'alex' clark pillow to version 9.3.0+aikido.10.
- Update jeffrey 'alex' clark pillow to version 9.5.0+aikido.8.
- Update jeffrey 'alex' clark pillow to version 9.5.0+aikido.12.
- Update rootio-pillow to version 9.5.0+root.io.5.
- Update debian pillow to version 9.4.0-1.1+deb12u1.
- Update debian pillow to version 10.2.0-1.
- Update pillow to version 9.5.0+aikido.13.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | jeffrey 'alex' clark | pillow |
< 10.2.0 Fix: upgrade to 10.2.0
|
| – | python | pillow |
<= 10.1.0 cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Root:PyPI | – | rootio-pillow |
< 9.3.0+root.io.1 < 9.5.0+root.io.4 < 9.5.0+root.io.7 < 9.3.0+root.io.7 < 9.3.0+root.io.9 < 9.5.0+root.io.5 Fix: upgrade to 9.3.0+root.io.1
|
| Root:PyPI | jeffrey 'alex' clark | pillow |
< 9.3.0+aikido.1 < 9.3.0+aikido.10 < 9.5.0+aikido.8 < 9.5.0+aikido.12 Fix: upgrade to 9.3.0+aikido.1
|
| Debian:12 | debian | pillow |
< 9.4.0-1.1+deb12u1 Fix: upgrade to 9.4.0-1.1+deb12u1
|
| Debian:13 | debian | pillow |
< 10.2.0-1 Fix: upgrade to 10.2.0-1
|
| Root:PyPI | – | pillow |
< 9.5.0+aikido.13 Fix: upgrade to 9.5.0+aikido.13
|
Original advisory text
CVE-2023-50447 in pillow - Patched by Root
Root has patched CVE-2023-50447 in the pillow package for Root:PyPI. Multiple fixed versions available.
References
- https://devhub.checkmarx.com/cve-details/CVE-2023-50447/ Third Party Advisory
- https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/
- https://nvd.nist.gov/vuln/detail/CVE-2023-50447
- https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc...
- https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security
- http://www.openwall.com/lists/oss-security/2024/01/20/1
- https://github.com/python-pillow/Pillow/releases
- https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html
- https://devhub.checkmarx.com/cve-details/CVE-2023-50447
- https://duartecsantos.github.io/2023-01-02-CVE-2023-50447
- https://duartecsantos.github.io/2024-01-02-CVE-2023-50447
- https://github.com/advisories/GHSA-3f63-hfp8-52jq
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50447... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-50447 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-94Code Injection
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Timeline
Published12 Oct 2026
Updated12 Oct 2026
First seen6 Mar 2026
Sources
GHSA-3f63-hfp8-52jq · GHSA
CVE-2023-50447 · NVD
CVE-2023-50447 · OSV
DEBIAN-CVE-2023-50447 · OSV
Track software like this
Free during beta