### Summary
`launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.
### Impact
#### Direct `launch-editor` users
Only apps that match all of the following conditions are affected:
- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory
- The user uses or the app specifies any of the following editors:
- Vim (including gVim)
- MacVim
- Emacs (including Emacsclient)
- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
- The first argument of `launchEditor` can start with `+` or `-` or the user is using WSL
#### `launch-editor-middleware` users
Only apps that match the following conditions are affected:
- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory
- The user uses or the app specifies any of the following editors:
- Vim (including gVim)
- MacVim
- Emacs (including Emacsclient)
- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
- launch-editor older than v2.2.0 is used, or the user is using WSL
#### Vite users
Only apps that match the following conditions are affected:
- The attacker is able to create a file system entry (e.g. a file or directory) starting with `+` or `-` in the working directory
- The user uses or the app specifies any of the following editors:
- Vim (including gVim)
- MacVim
- Emacs (including Emacsclient)
- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
- The user is using WSL
### Details
`launchEditor(file)` function passes the file name as-is to the editor if the file with that file name exists. If the file name starts with `-` (also `+` for Vim), the editor treats them as flags rather than positional arguments. For example, Vim treats arguments starting with `+` as an Ex command. As a result, an existing relative directory such as:
```
+call writefile(["SAFE_MARKER"],"LAUNCH_EDITOR_MARKER")|qa!
```
is not treated as a filename when passed to Vim. Vim executes the embedded Ex command.
The following editor has a potentially destructive operation exposed to the CLI arguments:
- Vim (including gVim)
- MacVim
- Emacs (including Emacsclient)
- Notepad++ (only if using a plugin exposing dangerous operations via plugin messages)
`launch-editor-middleware` v2.2.0+ converts the passed file path to an absolute path so those are not affected as long as the user is not using WSL. For WSL, `launch-editor` converts the paths to relative paths internally, so those are still affected.
Vite 2.0.0+ uses `launch-editor-middleware` v2.2.0+ so the WSL users are only affected.
### Summary
`PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) **without sanitization**, placing it at `-f <infile>`. A filename beginning with `-` is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with `-dSAFER` enabled).
### Details
_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._
#### Type
CWE-88 (Argument Injection) (→ CWE-78 (OS Command Injection) optionally, with attacker controlled text file)
#### Vulnerable Codes
```python
infile_temp = None
if hasattr(fp, "name") and os.path.exists(fp.name):
infile = fp.name # user-controlled path used as-is, without validation
else:
in_fd, infile_temp = tempfile.mkstemp()
os.close(in_fd)
infile = infile_temp
# ... (copy fp into a temporary file)
# Build Ghostscript command
command = [
gs_binary,
"-q",
f"-g{width:d}x{height:d}",
f"-r{res_x:f}x{res_y:f}",
"-dBATCH",
"-dNOPAUSE",
"-dSAFER", # default sandbox — does NOT stop this injection
f"-sDEVICE={device}",
f"-sOutputFile={outfile}",
"-c",
f"{-bbox[0]} {-bbox[1]} translate",
"-f",
infile, # injected here: inserted into argv with no check for
# option prefixes (-, --) or Ghostscript's @-file token
# => argument injection (CWE-88)
"-c",
"showpage",
]
# ...
subprocess.check_call(command, startupinfo=startupinfo) # spawns Ghostscript
```
#### Root cause.
When rendering an EPS image, PIL.EpsImagePlugin.Ghostscript() constructs the Ghostscript command line using the input file path (fp.name) and places it directly at the -f <infile> position of the argument list. This path is user-controllable, yet Pillow performs no validation or neutralization of tokens that Ghostscript treats specially during command-line argument parsing — in particular a leading - or -- (which Ghostscript interprets as an option rather than a filename) and a leading @ (Ghostscript's argument-file syntax, which causes it to read additional command-line arguments from the named file). Because the filename is neither normalized (e.g., forced to an absolute path or prefixed with ./) nor checked against these prefixes before being handed to the subprocess, an attacker who controls the filename passed to Image.open() can inject arbitrary Ghostscript command-line arguments. This is a classic argument-injection flaw (CWE-88), and it is not mitigated by Pillow's default -dSAFER setting.
#### Affected
- Pillow: tested on 12.3.0 (latest); vulnerable code is long-standing and appears to affect all current versions (main included).
- Component: `src/PIL/EpsImagePlugin.py`, `Ghostscript()` — `infile = fp.name`, and the command list entry `"-f", infile`.
#### Suggested fix
Normalize the filename to an absolute path before it is passed to Ghostscript, so it can never be parsed as an option (`-`/`--`) or as an argument-file token (`@`):
```python
if hasattr(fp, "name") and os.path.exists(fp.name):
infile = os.path.abspath(fp.name) # was: infile = fp.name
```
`os.path.abspath()` guarantees the path starts with a path separator (or a drive letter on Windows), so a leading `-` or `@` can no longer reach Ghostscript's argument parser. The `else` branch already builds a safe `tempfile.mkstemp()` path and needs no change.
### PoC
dockerfile, Default run shows the argument-injection demo (poc.py); for the RCE PoC run python3 poc-rce.py.
```
FROM ubuntu:24.04
RUN apt update
RUN apt install -y --no-install-recommends python3 python3-venv ghostscript ca-certificates
RUN rm -rf /var/lib/apt/lists/*
RUN python3 -m venv /venv && /venv/bin/pip install --upgrade pip Pillow==12.3.0
ENV PATH=/venv/bin:$PATH
WORKDIR /poc
COPY poc.py .
COPY poc-rce.py .
COPY arg .
CMD ["python3", "poc.py"]
```
poc.py
```
import os
from PIL import Image
############################################################################################
# Attacker controlled file
############################################################################################
EPS = b"%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n%%EndComments\nshowpage\n"
name = "-h"
with open(name, "wb") as f:
f.write(EPS)
############################################################################################
print(f"[*] Pillow opens a file whose name is {name!r}")
im = Image.open(name)
print(f"[*] call `load()`; this paths calls `gs` command with '-f {name}'")
try:
im.load()
except Exception as e:
print(f"[*] load() raised: {type(e).__name__}: {e}")
print("CWE-88: argument injection; Pillow code doesn't validate argument name")
print(" This poc.py shows the vulnerability clearly.")
print("
CVE-2026-96620 is a critical vulnerability in the anthropics claude-agent-sdk-python prior to version 0.2.121. The issue arises from improper input validation of the resume option passed to the Claude CLI, allowing an attacker to inject CLI flags such as --mcp-config. This can lead to arbitrary command execution at CLI startup, bypassing SDK permission controls. The vulnerability is fixed in version 0.2.121.
VNote versions prior to 4.3.0 contain an OS command injection vulnerability due to improper neutralization of special elements in note filenames. Specifically, attacker-controlled double quotes in POSIX note filenames can break out of quoted paths and inject arguments into external program commands. This can lead to arbitrary command execution if the external program supports command execution via arguments. The issue is fixed in version 4.3.0.
CVE-2026-97798 is a high-severity vulnerability in Microsoft Windows 10 Version 21H2 involving improper neutralization of argument delimiters in Windows Error Reporting. This argument injection flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple builds of Windows 10 Version 21H2 prior to specific fixed versions. Microsoft has released official fixes for all affected versions.
CVE-2026-92892 is a critical vulnerability in JFrog CLI that allows argument injection leading to potential arbitrary code execution under specific configurations. The flaw affects versions prior to 2.128.0. A fix is available in version 2.128.0 and later.
CVE-2026-108963 is a high-severity vulnerability in databasement before version 1.8.2 that allows authenticated users to perform remote code execution. The issue arises because databasement runs commands like mariadb-dump with a database name argument that can be controlled by any authenticated user. This argument injection can lead to indirect code execution, such as writing files to arbitrary locations like /app/public/index.php. The vulnerability is due to improper neutralization of argument delimiters (CWE-88).
SumatraPDF versions 3.6.1 and earlier contain an argument injection vulnerability in the SelectionTranslate.cpp source file. The issue arises from incomplete quote-only escaping when embedding selected or pasted translation text into Windows command lines. This flaw affects specific functions that build command lines for translation agents, potentially allowing attacker-controlled input to inject unauthorized command-line flags. No fixed version is currently available, and the vulnerability requires user interaction and local access. The impact is limited to scenarios where the corresponding agentic CLI backend is installed and used.
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW(). A user with an external editor configured or auto-detected who opens a PDF with a crafted .synctex.gz file and invokes inverse search can inject command-line flags; the resulting impact depends on the target editor interpreting those flags and can include unintended editor actions or code execution through a malicious extension. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
CVE-2026-11939 is a low-severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access that may allow audit log forgery due to improper neutralization of argument delimiters (CWE-88). It affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The vulnerability does not impact confidentiality or availability but can affect the integrity of audit logs.
CVE-2026-18740 is a high-severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access that allows a remote authenticated attacker to perform unauthorized actions via argument injection. It affects versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. The vulnerability stems from improper neutralization of argument delimiters in a command, classified as CWE-88.
CVE-2026-19482 is a high-severity vulnerability in IBM Security Verify Access and IBM Verify Identity Access versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. It allows a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments (CWE-88). The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability.
An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search string options before passing them to internal search commands. An authenticated user with low-privilege administrative access can exploit this vulnerability to read arbitrary files on the local operating system, including sensitive configuration files, system password hashes and system secrets.
CVE-2026-87687 is a high-severity vulnerability in Brocade Fabric OS that affects versions before 9.2.2d and versions 10.0.0 through 10.0.0a1. It allows an authenticated user with restricted privileges in one Virtual Fabric to exploit improper input validation by submitting a specially crafted request with an arbitrary fabric identifier. This leads to unauthorized cross-fabric operations and unauthorized viewing of configuration details in other Virtual Fabrics or tenants.
CVE-2026-105791 is a command injection vulnerability in Microsoft UFO, an open-source automation framework. The flaw exists in the run_shell tool of the CommandLineExecutor component prior to version 3.0.9. It improperly validates only the first token of the bash_command parameter and allows explorer.exe to be used, which on Windows can delegate execution to arbitrary executables or scripts. Exploitation requires a user to run an affected agent workflow and trigger the vulnerable tool call. Successful exploitation can lead to arbitrary code execution with the privileges of the desktop user, potentially allowing access or modification of user files, tokens, and sessions. The issue is fixed in version 3.0.9.
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool in ufo/client/mcp/http_servers/linux_mcp_server.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output forms. An authenticated caller can use sort -o or the optional second uniq operand to create or overwrite files writable by the UFO server process without shell metacharacters, because the allowed binary opens the destination itself and the argument policy does not reject the operation. This can corrupt configuration or other writable data and disrupt the service, but the demonstrated primitive does not directly disclose files or establish arbitrary code execution. This issue is fixed in version 3.0.9.
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-controlled text and package_name parameters into adb shell command argument positions without comprehensive validation. The adb client joins those arguments into a remote command string that the Android shell reparses, allowing shell metacharacters to execute additional commands on an authorized connected device as the Android shell user. Exploitation requires a valid Mobile MCP API key and a reachable device authorized for ADB, and it does not establish host operating-system execution, Android root execution, or access beyond the Android shell-user privileges. This issue is fixed in version 3.0.10.