Pillow, a widely used Python imaging library, contains an OS command injection flaw in the WindowsViewer.get_command() function. The function builds a cmd.exe command by embedding a file path directly into an f‑string and passes it to subprocess.Popen with shell=True. Because the path is not escaped, any shell metacharacters present in the file path can be injected, allowing an attacker to run arbitrary cmd.exe commands. This vulnerability is classified as CWE‑78, representing an input validation weakness.

The flaw affects all Windows installations that run Pillow versions older than 12.3.0. Any Python process that invokes WindowsViewer.get_command can trigger the issue, which means that many applications that load images are potentially vulnerable regardless of the host application.

The CVSS score of 4.5 reflects moderate severity, and the EPSS score is below 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local or remote when an application can receive an image file whose path is controlled by an attacker. An attacker would supply a file name or path containing shell metacharacters to the WindowsViewer.get_command function. The success of the exploit depends on the privileges of the Python process; elevated privileges could lead to system‑wide compromise, while lower privileges would limit the attacker to the application context. Because the flaw is not network exposed by itself, exploitation typically requires local code execution or an indirect path such as an uncontrolled image source within an application.