From ce6bcd3337353c2a98681f6ea6d806f2a0c7d11a Mon Sep 17 00:00:00 2001 From: Yogita Urade Date: Thu, 15 Oct 2026 23:23:23 -0700 Subject: [PATCH] python3-pillow: CVE_STATUS for CVE-2026-55798 Analysis: - The vulnerable code is WindowsViewer.get_command() constructing an unescaped cmd.exe command from a file path. [1] - Linux uses UnixViewer, which quotes the path, so this Windows command path is not used by the target recipe. [1] - Hence marking this CVE not applicable for the Linux target. [1] https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6 Signed-off-by: Yogita Urade Signed-off-by: Anuj Mittal --- meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb index e5ef7b34bf..33fd1d8872 100644 --- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb @@ -70,6 +70,7 @@ RDEPENDS:${PN}-ptest += " \ " CVE_PRODUCT = "pillow" +CVE_STATUS[CVE-2026-55798] = "not-applicable-platform: The CVE affects WindowsViewer/cmd.exe; the Linux target uses UnixViewer" RPROVIDES:${PN} += "python3-imaging"