Command and Code Injection

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expressi…CVE-2023-50447Python · CVSS 8.1 · 1.7% likely

   CWE-95

2. Email header injection due to unquoted newlinesCVE-2024-6923Python Software Foundation · CVSS 5.5 · 1.1% likely

   CWE-94

3. IMAP command injection in user-controlled commandsCVE-2025-15366Python Software Foundation · CVSS 5.9 · 0.4% likely

   CWE-77

4. POP3 command injection in user-controlled commandsCVE-2025-15367Python Software Foundation · CVSS 5.9 · 0.4% likely

   CWE-77

5. Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()CVE-2026-4786Python Software Foundation · CVSS 7.1 · 0.3% likely

   CWE-77

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.