Pillow, the most popular image processing library for Python, contains a critical vulnerability (CVE-2026-112900) that allows remote code execution. The flaw lies in how Pillow handles EPS images; it passes the file’s name directly to Ghostscript without proper sanitization. A specially crafted EPS image can trick Pillow into executing arbitrary operating system commands on the server, posing a significant risk to applications processing user-supplied images.