StackPrism

PyPI package

pillow 8.1.0 vulnerabilities, and the version that fixes all of them

pillow 8.1.0 has 42 known vulnerabilities (31 rated high or critical); 12.3.0 fixes all of them. CISA lists 2 of them as exploited in the wild.

PyPI (opens in a new tab) describes it as “Python Imaging Library (fork)”

Known vulnerabilities
42
31 rated high or critical
Released
Jan 2, 2021
Latest is 13.0.0
Licence
MIT-CMU
OpenSSF Scorecard
7.6/10
python-pillow/pillow (opens in a new tab)
Dependencies
None
Resolved by deps.dev

What to upgrade to

12.3.0 is the closest release with no known vulnerabilities.

  • 8.4.0

    Newest 8.x release. Released Oct 15, 2021.

    26 known vulnerabilities, worst rated warning

  • 12.3.0Upgrade to this

    Fixes all 42 known vulnerabilities. Released Jul 1, 2026.

    No known vulnerabilities

  • 13.0.0

    Latest release. Released Oct 16, 2026.

    No known vulnerabilities

12.3.0 came out on Jul 1, 2026. A coding agent trained before then doesn’t know it exists, so it may suggest an older release. AI knowledge cutoff dates

Hand the fix to your coding agent

One task with the upgrade, the file to change and why. Paste it into Claude Code, Cursor or Codex.

Findings

Every advisory for pillow 8.1.0

Known exploited first (CISA KEV), then by how likely they are to be exploited (FIRST EPSS), then by severity. Each id links to its OSV.dev record.

  1. CriticalPYSEC-2023-175 on OSV.dev (opens in a new tab)Exploited in the wild (CISA)EPSS: top 1%

    Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.

    Fixed in 10.0.1. Published Sep 20, 2023.

  2. CriticalCVE-2023-4863 on OSV.dev (opens in a new tab)CVE-2023-5129Exploited in the wild (CISA)EPSS: top 1%

    libwebp: OOB write in BuildHuffmanTable

    Fixed in 10.0.1. Published Sep 12, 2023.

  3. CriticalCVE-2021-27922 on OSV.dev (opens in a new tab)GHSA-3wvg-mj6g-m9cvEPSS: top 9%

    Pillow Uncontrolled Resource Consumption

    Fixed in 8.1.2. Published Mar 18, 2021.

  4. CriticalCVE-2022-22817 on OSV.dev (opens in a new tab)GHSA-8vj2-vxx3-667wEPSS: top 12%

    Arbitrary expression injection in Pillow

    Fixed in 9.0.1. Published Jan 12, 2022.

  5. CriticalCVE-2021-34552 on OSV.dev (opens in a new tab)GHSA-7534-mm45-c74vEPSS: top 13%

    Buffer Overflow in Pillow

    Fixed in 8.3.0. Published Oct 5, 2021.

  6. CriticalCVE-2021-23437 on OSV.dev (opens in a new tab)GHSA-98vv-pw6r-q6q4EPSS: top 13%

    Uncontrolled Resource Consumption in pillow

    Fixed in 8.3.2. Published Sep 7, 2021.

  7. CriticalCVE-2021-27921 on OSV.dev (opens in a new tab)GHSA-f4w8-cv6p-x6r5EPSS: top 13%

    Pillow Denial of Service by Uncontrolled Resource Consumption

    Fixed in 8.1.2. Published Mar 18, 2021.

  8. CriticalCVE-2021-27923 on OSV.dev (opens in a new tab)GHSA-95q3-8gr9-gm8wEPSS: top 13%

    Pillow Denial of Service by Uncontrolled Resource Consumption

    Fixed in 8.1.2. Published Mar 18, 2021.

  9. CriticalCVE-2021-25287 on OSV.dev (opens in a new tab)GHSA-77gc-v2xv-rvvhEPSS: top 14%

    Out-of-bounds Read in Pillow

    Fixed in 8.2.0. Published Jun 8, 2021.

  10. CriticalCVE-2022-24303 on OSV.dev (opens in a new tab)GHSA-9j59-75qj-795wEPSS: top 15%

    Path traversal in Pillow

    Fixed in 9.0.1. Published Mar 11, 2022.

  11. WarningCVE-2022-22815 on OSV.dev (opens in a new tab)GHSA-pw3c-h7wp-cvhxEPSS: top 16%

    Improper Initialization in Pillow

    Fixed in 9.0.0. Published Jan 12, 2022.

  12. CriticalCVE-2021-28676 on OSV.dev (opens in a new tab)GHSA-7r7m-5h27-29hpEPSS: top 16%

    Potential infinite loop in Pillow

    Fixed in 8.2.0. Published Jun 8, 2021.

  13. CriticalCVE-2021-25288 on OSV.dev (opens in a new tab)GHSA-rwv7-3v45-hg29EPSS: top 17%

    Pillow Out-of-bounds Read vulnerability

    Fixed in 8.2.0. Published Jun 8, 2021.

  14. CriticalCVE-2021-25290 on OSV.dev (opens in a new tab)GHSA-8xjq-8fcg-g5hwEPSS: top 17%

    Out-of-bounds Write in Pillow

    Fixed in 8.1.1. Published Mar 29, 2021.

  15. CriticalCVE-2021-25289 on OSV.dev (opens in a new tab)GHSA-57h3-9rgr-c24mEPSS: top 17%

    Out of bounds write in Pillow

    Fixed in 8.1.1. Published Mar 29, 2021.

  16. CriticalCVE-2021-28677 on OSV.dev (opens in a new tab)GHSA-q5hq-fp76-qmrcEPSS: top 17%

    Uncontrolled Resource Consumption in Pillow

    Fixed in 8.2.0. Published Jun 8, 2021.

  17. WarningCVE-2022-22816 on OSV.dev (opens in a new tab)GHSA-xrcv-f9gm-v42cEPSS: top 21%

    Out-of-bounds Read in Pillow

    Fixed in 9.0.0. Published Jan 12, 2022.

  18. CriticalCVE-2023-50447 on OSV.dev (opens in a new tab)GHSA-3f63-hfp8-52jqEPSS: top 24%

    Arbitrary Code Execution in Pillow

    Fixed in 10.2.0. Published Jan 19, 2024.

  19. WarningCVE-2021-25292 on OSV.dev (opens in a new tab)GHSA-9hx2-hgq2-2g4fEPSS: top 25%

    Regular Expression Denial of Service (ReDoS) in Pillow

    Fixed in 8.1.1. Published Mar 29, 2021.

  20. CriticalCVE-2021-25293 on OSV.dev (opens in a new tab)GHSA-p43w-g3c5-g5mqEPSS: top 25%

    Out of bounds read in Pillow

    Fixed in 8.1.1. Published Mar 29, 2021.

  21. CriticalCVE-2021-25291 on OSV.dev (opens in a new tab)GHSA-mvg9-xffr-p774EPSS: top 29%

    Out of bounds read in Pillow

    Fixed in 8.2.0. Published Mar 29, 2021.

  22. CriticalCVE-2022-45198 on OSV.dev (opens in a new tab)GHSA-m2vv-5vj5-2hm7EPSS: top 31%

    Pillow vulnerable to Data Amplification attack.

    Fixed in 9.2.0. Published Nov 14, 2022.

  23. WarningCVE-2022-45199 on OSV.dev (opens in a new tab)GHSA-q4mp-jvh2-76fjEPSS: top 33%

    Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

    Fixed in 9.3.0. Published Nov 14, 2022.

  24. CriticalCVE-2023-44271 on OSV.dev (opens in a new tab)GHSA-8ghj-p4vj-mr35EPSS: top 35%

    Pillow Denial of Service vulnerability

    Fixed in 10.0.0. Published Nov 3, 2023.

  25. CriticalCVE-2024-28219 on OSV.dev (opens in a new tab)GHSA-44wm-f244-xhp3EPSS: top 38%

    Pillow buffer overflow vulnerability

    Fixed in 10.3.0. Published Apr 3, 2024.

  26. CriticalCVE-2021-28675 on OSV.dev (opens in a new tab)GHSA-g6rj-rv7j-xwp4EPSS: top 40%

    Pillow denial of service

    Fixed in 8.2.0. Published Jun 8, 2021.

  27. WarningCVE-2021-28678 on OSV.dev (opens in a new tab)GHSA-hjfx-8p6c-g7gxEPSS: top 47%

    Insufficient Verification of Data Authenticity in Pillow

    Fixed in 8.2.0. Published Jun 8, 2021.

  28. CriticalCVE-2026-54058 on OSV.dev (opens in a new tab)GHSA-62p4-gmf7-7g93EPSS: top 58%

    Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

    Fixed in 12.3.0. Published Jul 20, 2026.

  29. CriticalCVE-2026-59197 on OSV.dev (opens in a new tab)GHSA-xj96-63gp-2gmrEPSS: top 63%

    Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

    Fixed in 12.3.0. Published Jul 20, 2026.

  30. CriticalCVE-2026-55379 on OSV.dev (opens in a new tab)GHSA-45hq-cxwh-f6vcEPSS: top 66%

    Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

    Fixed in 12.3.0. Published Jul 20, 2026.

  31. CriticalCVE-2026-55380 on OSV.dev (opens in a new tab)GHSA-phj9-mv4w-65pmEPSS: top 66%

    Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

    Fixed in 12.3.0. Published Jul 20, 2026.

  32. CriticalCVE-2026-54060 on OSV.dev (opens in a new tab)GHSA-5x94-69rx-g8h2EPSS: top 66%

    Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

    Fixed in 12.3.0. Published Jul 20, 2026.

  33. CriticalCVE-2026-54059 on OSV.dev (opens in a new tab)GHSA-8v84-f9pq-wr9xEPSS: top 67%

    Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

    Fixed in 12.3.0. Published Jul 20, 2026.

  34. CriticalCVE-2026-59205 on OSV.dev (opens in a new tab)GHSA-9hw9-ch79-4vh6EPSS: top 69%

    Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

    Fixed in 12.3.0. Published Jul 20, 2026.

  35. CriticalCVE-2026-59200 on OSV.dev (opens in a new tab)GHSA-jjj6-mw9f-p565EPSS: top 69%

    Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

    Fixed in 12.3.0. Published Jul 20, 2026.

  36. CriticalCVE-2026-59199 on OSV.dev (opens in a new tab)GHSA-6r8x-57c9-28j4EPSS: top 69%

    Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

    Fixed in 12.3.0. Published Jul 20, 2026.

  37. WarningCVE-2026-59198 on OSV.dev (opens in a new tab)GHSA-fj7v-r99m-22gqEPSS: top 78%

    Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

    Fixed in 12.3.0. Published Jul 20, 2026.

  38. WarningCVE-2026-55798 on OSV.dev (opens in a new tab)GHSA-4x4j-2g7c-83w6EPSS: top 94%

    Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

    Fixed in 12.3.0. Published Jul 20, 2026.

  39. WarningCVE-2026-42310 on OSV.dev (opens in a new tab)GHSA-r73j-pqj5-w3x7EPSS: top 94%

    Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

    Fixed in 12.2.0. Published May 4, 2026.

  40. WarningCVE-2026-42308 on OSV.dev (opens in a new tab)GHSA-wjx4-4jcj-g98jEPSS: top 96%

    Pillow has an integer overflow when processing fonts

    Fixed in 12.2.0. Published May 4, 2026.

  41. WarningGHSA-jgpv-4h4c-xhw3 on OSV.dev (opens in a new tab)

    Uncontrolled Resource Consumption in pillow

    Fixed in 8.1.2. Published Apr 23, 2021.

  42. LowGHSA-4fx9-vc88-q2xc on OSV.dev (opens in a new tab)

    Infinite loop in Pillow

    Fixed in 9.0.0. Published Mar 11, 2022.

Is pillow the only one?

Paste a public GitHub repo or drop your requirements.txt or pyproject.toml and see every vulnerable, end-of-life or deprecated dependency, with one fix task. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism asks OSV.dev which advisories affect exactly pillow 8.1.0, merges duplicates filed under several ids, and ranks them with CISA’s Known Exploited Vulnerabilities list and FIRST EPSS. Release dates and deprecation come from deps.dev and PyPI. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against PyPI, OSV.dev, deps.dev, CISA KEV and FIRST EPSS.