CVE-2026-55798

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

• pillow (Only affects Windows specific WindowsViewer) https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6