CVE-2022-22817: Improper Control of Generation of Code ('Code Injection')

January 10, 2022 (updated December 10, 2023)

PIL.ImageMath.eval in Pillow allows evaluation of arbitrary expressions, such as ones that use the Python exec method.

References

nvd.nist.gov/vuln/detail/CVE-2022-22817
pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html

Detect and mitigate CVE-2022-22817 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →