A critical 12-year-old RCE flaw in Pillow, Python's most popular imaging library, let attackers inject commands through filenames passed to Ghostscript. CVSS 4.0 score: 9.2. Fixed in https://deafnews.it/en/article/pillow-1300-fixes-rce-the-filename-not-the-file-was-the-threat