CVE-2022-22817
9.8
CRITICAL · CVSS 3.1 · EPSS 3.3% (pctl 88)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.33% — more likely to be exploited than 88% of all CVEs |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2022-01-10 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| debian | debian linux |
| python | pillow |
References
- https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
- https://security.gentoo.org/glsa/202211-10
- https://www.debian.org/security/2022/dsa-5053
- https://lists.debian.org/debian-lts-announce/2022/01/msg00018.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00021.html
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
- https://security.gentoo.org/glsa/202211-10
- https://www.debian.org/security/2022/dsa-5053
→ the Explorer · watch your stack · NVD