StackPrism

PyPI package

pillow 5.4.0 vulnerabilities, and the version that fixes all of them

pillow 5.4.0 has 56 known vulnerabilities (44 rated high or critical); 12.3.0 fixes all of them. CISA lists 2 of them as exploited in the wild.

PyPI (opens in a new tab) describes it as “Python Imaging Library (fork)”

Known vulnerabilities
56
44 rated high or critical
Released
Jan 1, 2019
Latest is 13.0.0
Licence
MIT-CMU
Dependencies
None
Resolved by deps.dev

What to upgrade to

12.3.0 is the closest release with no known vulnerabilities.

  • 5.4.1

    Newest 5.x release. Released Jan 6, 2019.

    55 known vulnerabilities, worst rated warning

  • 12.3.0Upgrade to this

    Fixes all 56 known vulnerabilities. Released Jul 1, 2026.

    No known vulnerabilities

  • 13.0.0

    Latest release. Released Oct 16, 2026.

    No known vulnerabilities

12.3.0 came out on Jul 1, 2026. A coding agent trained before then doesn’t know it exists, so it may suggest an older release. AI knowledge cutoff dates

Hand the fix to your coding agent

One task with the upgrade, the file to change and why. Paste it into Claude Code, Cursor or Codex.

Findings

Every advisory for pillow 5.4.0

Known exploited first (CISA KEV), then by how likely they are to be exploited (FIRST EPSS), then by severity. Each id links to its OSV.dev record.

  1. CriticalPYSEC-2023-175 on OSV.dev (opens in a new tab)Exploited in the wild (CISA)

    Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.

    Fixed in 10.0.1. Published Sep 20, 2023.

  2. CriticalCVE-2023-4863 on OSV.dev (opens in a new tab)CVE-2023-5129Exploited in the wild (CISA)

    libwebp: OOB write in BuildHuffmanTable

    Fixed in 10.0.1. Published Sep 12, 2023.

  3. CriticalCVE-2026-59205 on OSV.dev (opens in a new tab)GHSA-9hw9-ch79-4vh6

    Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

    Fixed in 12.3.0. Published Jul 20, 2026.

  4. CriticalCVE-2026-59200 on OSV.dev (opens in a new tab)GHSA-jjj6-mw9f-p565

    Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

    Fixed in 12.3.0. Published Jul 20, 2026.

  5. CriticalCVE-2026-59199 on OSV.dev (opens in a new tab)GHSA-6r8x-57c9-28j4

    Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

    Fixed in 12.3.0. Published Jul 20, 2026.

  6. CriticalCVE-2026-59197 on OSV.dev (opens in a new tab)GHSA-xj96-63gp-2gmr

    Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

    Fixed in 12.3.0. Published Jul 20, 2026.

  7. CriticalCVE-2026-55380 on OSV.dev (opens in a new tab)GHSA-phj9-mv4w-65pm

    Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

    Fixed in 12.3.0. Published Jul 20, 2026.

  8. CriticalCVE-2026-55379 on OSV.dev (opens in a new tab)GHSA-45hq-cxwh-f6vc

    Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

    Fixed in 12.3.0. Published Jul 20, 2026.

  9. CriticalCVE-2026-54060 on OSV.dev (opens in a new tab)GHSA-5x94-69rx-g8h2

    Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

    Fixed in 12.3.0. Published Jul 20, 2026.

  10. CriticalCVE-2026-54059 on OSV.dev (opens in a new tab)GHSA-8v84-f9pq-wr9x

    Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

    Fixed in 12.3.0. Published Jul 20, 2026.

  11. CriticalCVE-2026-54058 on OSV.dev (opens in a new tab)GHSA-62p4-gmf7-7g93

    Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

    Fixed in 12.3.0. Published Jul 20, 2026.

  12. CriticalCVE-2024-28219 on OSV.dev (opens in a new tab)GHSA-44wm-f244-xhp3

    Pillow buffer overflow vulnerability

    Fixed in 10.3.0. Published Apr 3, 2024.

  13. CriticalCVE-2023-50447 on OSV.dev (opens in a new tab)GHSA-3f63-hfp8-52jq

    Arbitrary Code Execution in Pillow

    Fixed in 10.2.0. Published Jan 19, 2024.

  14. CriticalCVE-2023-44271 on OSV.dev (opens in a new tab)GHSA-8ghj-p4vj-mr35

    Pillow Denial of Service vulnerability

    Fixed in 10.0.0. Published Nov 3, 2023.

  15. CriticalCVE-2022-45198 on OSV.dev (opens in a new tab)GHSA-m2vv-5vj5-2hm7

    Pillow vulnerable to Data Amplification attack.

    Fixed in 9.2.0. Published Nov 14, 2022.

  16. CriticalCVE-2020-5311 on OSV.dev (opens in a new tab)GHSA-r7rm-8j6h-r933

    Buffer Copy without Checking Size of Input in Pillow

    Fixed in 6.2.2. Published May 24, 2022.

  17. CriticalCVE-2022-24303 on OSV.dev (opens in a new tab)GHSA-9j59-75qj-795w

    Path traversal in Pillow

    Fixed in 9.0.1. Published Mar 11, 2022.

  18. CriticalCVE-2022-22817 on OSV.dev (opens in a new tab)GHSA-8vj2-vxx3-667w

    Arbitrary expression injection in Pillow

    Fixed in 9.0.1. Published Jan 12, 2022.

  19. CriticalCVE-2020-5312 on OSV.dev (opens in a new tab)GHSA-p49h-hjvm-jg3h

    PCX P mode buffer overflow in Pillow

    Fixed in 6.2.2. Published Nov 3, 2021.

  20. CriticalCVE-2020-10378 on OSV.dev (opens in a new tab)GHSA-3xv8-3j54-hgrp

    Out-of-bounds read in Pillow

    Fixed in 7.1.0. Published Nov 3, 2021.

  21. CriticalCVE-2020-5310 on OSV.dev (opens in a new tab)GHSA-vcqg-3p29-xw73

    Integer overflow in Pillow

    Fixed in 6.2.2. Published Nov 3, 2021.

  22. CriticalCVE-2021-34552 on OSV.dev (opens in a new tab)GHSA-7534-mm45-c74v

    Buffer Overflow in Pillow

    Fixed in 8.3.0. Published Oct 5, 2021.

  23. CriticalCVE-2021-23437 on OSV.dev (opens in a new tab)GHSA-98vv-pw6r-q6q4

    Uncontrolled Resource Consumption in pillow

    Fixed in 8.3.2. Published Sep 7, 2021.

  24. CriticalCVE-2021-28677 on OSV.dev (opens in a new tab)GHSA-q5hq-fp76-qmrc

    Uncontrolled Resource Consumption in Pillow

    Fixed in 8.2.0. Published Jun 8, 2021.

  25. CriticalCVE-2021-25288 on OSV.dev (opens in a new tab)GHSA-rwv7-3v45-hg29

    Pillow Out-of-bounds Read vulnerability

    Fixed in 8.2.0. Published Jun 8, 2021.

  26. CriticalCVE-2021-28675 on OSV.dev (opens in a new tab)GHSA-g6rj-rv7j-xwp4

    Pillow denial of service

    Fixed in 8.2.0. Published Jun 8, 2021.

  27. CriticalCVE-2021-25287 on OSV.dev (opens in a new tab)GHSA-77gc-v2xv-rvvh

    Out-of-bounds Read in Pillow

    Fixed in 8.2.0. Published Jun 8, 2021.

  28. CriticalCVE-2021-28676 on OSV.dev (opens in a new tab)GHSA-7r7m-5h27-29hp

    Potential infinite loop in Pillow

    Fixed in 8.2.0. Published Jun 8, 2021.

  29. CriticalCVE-2021-25291 on OSV.dev (opens in a new tab)GHSA-mvg9-xffr-p774

    Out of bounds read in Pillow

    Fixed in 8.2.0. Published Mar 29, 2021.

  30. CriticalCVE-2021-25290 on OSV.dev (opens in a new tab)GHSA-8xjq-8fcg-g5hw

    Out-of-bounds Write in Pillow

    Fixed in 8.1.1. Published Mar 29, 2021.

  31. CriticalCVE-2021-25293 on OSV.dev (opens in a new tab)GHSA-p43w-g3c5-g5mq

    Out of bounds read in Pillow

    Fixed in 8.1.1. Published Mar 29, 2021.

  32. CriticalCVE-2021-25289 on OSV.dev (opens in a new tab)GHSA-57h3-9rgr-c24m

    Out of bounds write in Pillow

    Fixed in 8.1.1. Published Mar 29, 2021.

  33. CriticalCVE-2020-35653 on OSV.dev (opens in a new tab)GHSA-f5g8-5qq7-938w

    Pillow Out-of-bounds Read

    Fixed in 8.1.0. Published Mar 18, 2021.

  34. CriticalCVE-2020-35654 on OSV.dev (opens in a new tab)GHSA-vqcj-wrf2-7v73

    Pillow Out-of-bounds Write

    Fixed in 8.1.0. Published Mar 18, 2021.

  35. CriticalCVE-2021-27922 on OSV.dev (opens in a new tab)GHSA-3wvg-mj6g-m9cv

    Pillow Uncontrolled Resource Consumption

    Fixed in 8.1.2. Published Mar 18, 2021.

  36. CriticalCVE-2021-27921 on OSV.dev (opens in a new tab)GHSA-f4w8-cv6p-x6r5

    Pillow Denial of Service by Uncontrolled Resource Consumption

    Fixed in 8.1.2. Published Mar 18, 2021.

  37. CriticalCVE-2021-27923 on OSV.dev (opens in a new tab)GHSA-95q3-8gr9-gm8w

    Pillow Denial of Service by Uncontrolled Resource Consumption

    Fixed in 8.1.2. Published Mar 18, 2021.

  38. CriticalCVE-2020-10177 on OSV.dev (opens in a new tab)GHSA-cqhg-xjhh-p8hf

    Out-of-bounds reads in Pillow

    Fixed in 7.1.0. Published Jul 27, 2020.

  39. CriticalCVE-2020-10379 on OSV.dev (opens in a new tab)GHSA-8843-m7mw-mxqm

    Buffer overflow in Pillow

    Fixed in 7.1.0. Published Jul 27, 2020.

  40. CriticalCVE-2020-10994 on OSV.dev (opens in a new tab)GHSA-vj42-xq3r-hr3r

    Out-of-bounds reads in Pillow

    Fixed in 7.1.0. Published Jul 27, 2020.

  41. CriticalCVE-2020-11538 on OSV.dev (opens in a new tab)GHSA-43fq-w8qq-v88h

    Out-of-bounds read in Pillow

    Fixed in 7.1.0. Published Jul 27, 2020.

  42. CriticalCVE-2019-19911 on OSV.dev (opens in a new tab)GHSA-5gm3-px64-rw72

    Uncontrolled Resource Consumption in Pillow

    Fixed in 6.2.2. Published Apr 1, 2020.

  43. CriticalCVE-2020-5313 on OSV.dev (opens in a new tab)GHSA-hj69-c76v-86wr

    Out-of-bounds Read in Pillow

    Fixed in 6.2.2. Published Apr 1, 2020.

  44. CriticalCVE-2019-16865 on OSV.dev (opens in a new tab)GHSA-j7mj-748x-7p78

    DOS attack in Pillow when processing specially crafted image files

    Fixed in 6.2.0. Published Oct 22, 2019.

  45. WarningCVE-2026-59198 on OSV.dev (opens in a new tab)GHSA-fj7v-r99m-22gq

    Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

    Fixed in 12.3.0. Published Jul 20, 2026.

  46. WarningCVE-2026-55798 on OSV.dev (opens in a new tab)GHSA-4x4j-2g7c-83w6

    Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

    Fixed in 12.3.0. Published Jul 20, 2026.

  47. WarningCVE-2026-42310 on OSV.dev (opens in a new tab)GHSA-r73j-pqj5-w3x7

    Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

    Fixed in 12.2.0. Published May 4, 2026.

  48. WarningCVE-2026-42308 on OSV.dev (opens in a new tab)GHSA-wjx4-4jcj-g98j

    Pillow has an integer overflow when processing fonts

    Fixed in 12.2.0. Published May 4, 2026.

  49. WarningCVE-2022-45199 on OSV.dev (opens in a new tab)GHSA-q4mp-jvh2-76fj

    Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

    Fixed in 9.3.0. Published Nov 14, 2022.

  50. WarningCVE-2022-22815 on OSV.dev (opens in a new tab)GHSA-pw3c-h7wp-cvhx

    Improper Initialization in Pillow

    Fixed in 9.0.0. Published Jan 12, 2022.

  51. WarningCVE-2022-22816 on OSV.dev (opens in a new tab)GHSA-xrcv-f9gm-v42c

    Out-of-bounds Read in Pillow

    Fixed in 9.0.0. Published Jan 12, 2022.

  52. WarningCVE-2021-28678 on OSV.dev (opens in a new tab)GHSA-hjfx-8p6c-g7gx

    Insufficient Verification of Data Authenticity in Pillow

    Fixed in 8.2.0. Published Jun 8, 2021.

  53. WarningGHSA-jgpv-4h4c-xhw3 on OSV.dev (opens in a new tab)

    Uncontrolled Resource Consumption in pillow

    Fixed in 8.1.2. Published Apr 23, 2021.

  54. WarningCVE-2021-25292 on OSV.dev (opens in a new tab)GHSA-9hx2-hgq2-2g4f

    Regular Expression Denial of Service (ReDoS) in Pillow

    Fixed in 8.1.1. Published Mar 29, 2021.

  55. WarningCVE-2020-35655 on OSV.dev (opens in a new tab)GHSA-hf64-x4gq-p99h

    Pillow Out-of-bounds Read

    Fixed in 8.1.0. Published Mar 18, 2021.

  56. LowGHSA-4fx9-vc88-q2xc on OSV.dev (opens in a new tab)

    Infinite loop in Pillow

    Fixed in 9.0.0. Published Mar 11, 2022.

Is pillow the only one?

Paste a public GitHub repo or drop your requirements.txt or pyproject.toml and see every vulnerable, end-of-life or deprecated dependency, with one fix task. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism asks OSV.dev which advisories affect exactly pillow 5.4.0, merges duplicates filed under several ids, and ranks them with CISA’s Known Exploited Vulnerabilities list and FIRST EPSS. Release dates and deprecation come from deps.dev and PyPI. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against PyPI, OSV.dev, deps.dev, CISA KEV and FIRST EPSS (didn’t answer). Findings from that source may be missing; this page refreshes soon.