{"action":"Upgrade pillow to 13.0.0 or later.","affected":[{"fixed":"13.0.0","introduced":"11.1.0"}],"component":"pillow","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["13.0.0"],"ghsa_id":"GHSA-78g4-xqwv-q3g8","id":"tcs_01M5JMDN3ZWMEYAKCTD5PMFWDH","modified_at":"2026-10-22T17:15:04.326552524Z","published_at":"2026-10-22T17:01:08Z","references":["https://osv.dev/vulnerability/GHSA-78g4-xqwv-q3g8","https://github.com/python-pillow/Pillow/security/advisories/GHSA-78g4-xqwv-q3g8","https://github.com/python-pillow/Pillow/commit/5f8114c8096b181fae493543cd3837d9f9a971cc","https://github.com/python-pillow/Pillow/commit/d3470c327840f4c216a1610f30e7091dfd0b97c0","https://github.com/uclouvain/openjpeg/commit/91d08b11a72764f6d199f32fa0c1b1abd4edc2ad","https://github.com/python-pillow/Pillow","https://github.com/python-pillow/Pillow/releases/tag/13.0.0","https://osv.dev/vulnerability/OSV-2025-219"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-78g4-xqwv-q3g8","url":"https://osv.dev/vulnerability/GHSA-78g4-xqwv-q3g8"}],"summary":"Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()"}