{"action":"Upgrade pillow to 10.0.1 or later.","affected":[{"fixed":"10.0.1","introduced":"0"}],"component":"pillow","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["10.0.1"],"id":"tcs_01M5KGJPNBNJD1RFJ0DXX68F2G","modified_at":"2026-02-04T03:22:30.928037Z","published_at":"2023-09-20T05:29:33Z","references":["https://osv.dev/vulnerability/PYSEC-2023-175","https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst#1001-2023-09-15","https://nvd.nist.gov/vuln/detail/CVE-2023-5129","https://nvd.nist.gov/vuln/detail/CVE-2023-4863"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-175","url":"https://osv.dev/vulnerability/PYSEC-2023-175"}],"summary":"Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2."}