PYSEC-2023-175 — Vulnetix

PYSEC-2023-175 PUBLISHED

Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.

Affected Products

Vendor	Product	Versions
PyPI	pillow	0, 1.0, 1.2

Timeline

Sep 20, 2023 CVE Published
Sep 25, 2023 CVE Updated
Oct 5, 2023 PoC Published
Apr 28, 2025 PoC Published
Mar 7, 2026 Security Advisory
Mar 7, 2026 Security Advisory

References

https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15 advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-5129 advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-4863 advisory

Open in Interactive Console →