Pillow EPS flaw lets attacker-named files reach Ghostscript (CVE-2026-112900)
Pillow 13.0.0 fixes CVE-2026-112900, an argument injection in the EPS loader that can reach RCE through Ghostscript when an app opens an attacker-controlled filename. Upgrade from 2.6.0–12.3.0.