Pillow 13.0 fixes a command-execution flaw triggered by the filename, not the image

On October 16, 2026, the Python imaging library Pillow shipped version 13.0.0, fixing CVE-2026-112900: an attacker-controlled filename is passed to Ghostscript and runs commands on the server. Upgrade any Python pipeline that opens images, because the flaw affects a library downloaded roughly 436 million times a month.