StackRadar

CVE-2026-112899

Medium

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
307
of 18,208 indexed, latest versions
Container images
285
deployed by those charts
Fix available
1 of 1
affected package

Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

Carried by container images the latest versions of 307 of 18,208 indexed charts deploy, on 285 images.

Affected packageAffected versionsFixed inImages
pillowpypi2.6.1, 4.0.0, 4.3.0, 5.0.0+36 more13.0.0285
OSV records
GHSA-vx6w-vv9f-6gvg

Charts affected

307 by stars
ChartLatestAffected imagesRadar Score
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
pillow@11.3.0
13.0.0

Open the chart page →

14,774
clearml-servingallegroaiVerified publisher1.6.22 of 9See more

clearml-serving allegroai 1.6.2

2 of the 9 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
pillow@9.4.0
13.0.0
allegroai/clearml-serving-statistics:1.3.0c58d9da7bdf8
pillow@9.4.0
13.0.0

Open the chart page →

26,263
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
pillow@12.3.0
13.0.0

Open the chart page →

7,885
psonoankra-chartsVerified publisher1.2.01 of 2See more

psono ankra-charts 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
psono/psono-server:5.0.03b974b43ea03
pillow@10.3.0
13.0.0

Open the chart page →

2,659
music-assistantbdclark-helm-chartsVerified publisher0.4.151 of 1See more

music-assistant bdclark-helm-charts 0.4.15

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
pillow@12.3.0
13.0.0

Open the chart page →

5,023
squestchristianhuthVerified publisher7.0.21 of 4See more

squest christianhuth 7.0.2

1 of the 4 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
pillow@10.3.0
13.0.0

Open the chart page →

5,149
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
pillow@10.2.0
13.0.0

Open the chart page →

13,290
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
pillow@10.4.0
13.0.0

Open the chart page →

16,263
rommcrystalnetVerified publisher0.2.201 of 3See more

romm crystalnet 0.2.20

1 of the 3 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
zurdi15/romm:2.3.12db88fe44c89
pillow@10.1.0
13.0.0

Open the chart page →

2,168
aibrixdanchevVerified publisher0.8.01 of 5See more

aibrix danchev 0.8.0

1 of the 5 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.8.058b915e3708d
pillow@12.3.0
13.0.0

Open the chart page →

6,506
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
apsl/thumbor:6.7.051e2de5c2c70
pillow@5.4.1
13.0.0

Open the chart page →

43,506
mealiedeimosfr-charts1.0.171 of 1See more

mealie deimosfr-charts 1.0.17

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.29.078eb28b8776d
pillow@12.3.0
13.0.0

Open the chart page →

3,721
weblatedeliveryheroVerified publisher0.3.21 of 3See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
pillow@7.2.0
13.0.0

Open the chart page →

11,000
archerydoubanVerified publisher0.4.31 of 6See more

archery douban 0.4.3

1 of the 6 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
hhyo/archery:v1.9.11aa41843419e
pillow@9.0.1
13.0.0

Open the chart page →

8,226
seafiledr300481Verified publisher0.12.11 of 1See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:11.0.12d0c66e4621bd
pillow@10.2.0
13.0.0

Open the chart page →

76,503
craftycontrollerdrewburr-labs-helm-chartsVerified publisher0.3.01 of 1See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
pillow@12.2.0
13.0.0

Open the chart page →

40,180
eoapieoapiOfficialVerified publisher0.17.31 of 7See more

eoapi eoapi 0.17.3

1 of the 7 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/stac-utils/pgstac-pypgstac:v0.9.12672faad776b5
pillow@11.3.0
13.0.0

Open the chart page →

5,322
copypartyernail-copyparty2.0.01 of 1See more

copyparty ernail-copyparty 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
copyparty/ac:1.19.200a0a8605062c
pillow@11.2.1
13.0.0

Open the chart page →

2,176
taigafermosit0.0.111 of 7See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
pillow@12.0.0
13.0.0

Open the chart page →

10,283
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest33afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,196
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latest6acb4a5903eb
pillow@11.1.0
13.0.0

Open the chart page →

2,399
deepstackgeek-cookbookVerified publisher1.5.21 of 2See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
robmarkcole/deepstack-ui:latest410275726459
pillow@8.3.2
13.0.0

Open the chart page →

7,189
esphomegeek-cookbookVerified publisher8.4.21 of 1See more

esphome geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
esphome/esphome:1.18.03f51ec10e823
pillow@5.4.1
13.0.0

Open the chart page →

4,554
lazylibrariangeek-cookbookVerified publisher7.4.21 of 1See more

lazylibrarian geek-cookbook 7.4.2

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
linuxserver/lazylibrarian:version-1152df82f93d2560e233
pillow@8.2.0
13.0.0

Open the chart page →

12,497
paperlessgeek-cookbookVerified publisher9.2.01 of 1See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
pillow@9.2.0
13.0.0

Open the chart page →

4,969
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
pillow@9.0.0
13.0.0

Open the chart page →

8,862
bazarrhalkeye0.2.01 of 1See more

bazarr halkeye 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
linuxserver/bazarr:latestfb0437897eaa
pillow@12.3.0
13.0.0

Open the chart page →

307
hasher-matcher-actionerhasher-matcher-actioner1.0.01 of 1See more

hasher-matcher-actioner hasher-matcher-actioner 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/facebook/threatexchange/hma:1.0.1784d09c6b75a7
pillow@11.2.1
13.0.0

Open the chart page →

1,269
helmuphelmupVerified publisher0.1.02 of 3See more

helmup helmup 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
pillow@10.4.0
13.0.0
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
pillow@10.3.0
13.0.0

Open the chart page →

19,050
immichimmich-helmVerified publisher0.5.11 of 4See more

immich immich-helm 0.5.1

1 of the 4 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v3.3.41ab8674e7cec
pillow@12.3.0
13.0.0

Open the chart page →

9,723
supersetinseefrlab1.4.01 of 4See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
pillow@9.1.0
13.0.0

Open the chart page →

9,536
iris-webappiris-webapp0.2.41 of 2See more

iris-webapp iris-webapp 0.2.4

1 of the 2 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
pillow@11.3.0
13.0.0

Open the chart page →

13,628
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
pillow@10.3.0
13.0.0

Open the chart page →

22,692
langflow-idelangflow0.1.21 of 2See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
langflowai/langflow:latesta0396e089eb9
pillow@12.3.0
13.0.0

Open the chart page →

4,539
langflow-runtimelangflow0.1.11 of 1See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
langflowai/langflow:latesta0396e089eb9
pillow@12.3.0
13.0.0

Open the chart page →

331
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
pillow@11.0.0
13.0.0

Open the chart page →

5,045
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
pillow@11.3.0
13.0.0

Open the chart page →

8,239
home-assistantloeken-at-homeVerified publisher2026.9.21 of 1See more

home-assistant loeken-at-home 2026.9.2

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
loeken/home-assistant:2026.9.2b1dff5b4c593
pillow@12.3.0
13.0.0

Open the chart page →

2,513
mlflow-controllermlflow-deployment-controller0.1.81 of 2See more

mlflow-controller mlflow-deployment-controller 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
pillow@9.4.0
13.0.0

Open the chart page →

10,326
mlflow-servermlflowserver0.1.91 of 3See more

mlflow-server mlflowserver 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
buntha/mlflow:2.1.1154542cc3083
pillow@9.3.0
13.0.0

Open the chart page →

7,516
helm-taigamvitale1989-helm-taigaVerified publisher0.2.51 of 2See more

helm-taiga mvitale1989-helm-taiga 0.2.5

1 of the 2 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
mvitale1989/docker-taiga:20191031-4.2.141504ccda06df
pillow@4.3.0
13.0.0

Open the chart page →

6,507
odoonicholaswildeVerified publisher1.0.01 of 1See more

odoo nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/odoo:version-14.07cff9672ce07
pillow@5.4.1
13.0.0

Open the chart page →

7,630
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.51 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.5

1 of the 34 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-chatbot604b1f493c92
pillow@12.3.0
13.0.0

Open the chart page →

27,677
openvaultopenvaultVerified publisher0.9.01 of 2See more

openvault openvault 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
pillow@11.2.1
13.0.0

Open the chart page →

8,176
paperless-ngxpaperlessVerified publisher0.4.01 of 3See more

paperless-ngx paperless 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngxdigest-pinnedaa810a36942c
pillow@12.3.0
13.0.0

Open the chart page →

11,320
home-assistantpree-helm-chartsVerified publisher1.85.01 of 1See more

home-assistant pree-helm-charts 1.85.0

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,196
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
pillow@12.2.0
13.0.0

Open the chart page →

10,479
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
pillow@11.3.0
13.0.0

Open the chart page →

4,981
delugerubxkubeVerified publisher1.2.11 of 1See more

deluge rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
linuxserver/deluge:18.04.10ac871624394
pillow@5.1.0
13.0.0

Open the chart page →

14,282
sceptresceptreai0.1.122 of 5See more

sceptre sceptreai 0.1.12

2 of the 5 container images this version deploys carry CVE-2026-112899.

Container imageDigestPackageFixed in
maponyacharles/sceptreai:mlflow-0.1.1242d418654ebd
pillow@12.3.0
13.0.0
maponyacharles/sceptreai:api-0.1.127b37b092130a
pillow@12.3.0
13.0.0

Open the chart page →

6,197

Container images carrying it

285 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
opea/guardrails-tgi:latestf68bec6a1271
pillow@11.1.0
13.0.0
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
pillow@10.2.0
13.0.0
1
opea/speecht5:1.0249afad3d268
pillow@10.2.0
13.0.0
1
opea/tts:1.0257ae94709e9
pillow@10.2.0
13.0.0
1
opea/web-retriever-chroma:1.0fe08165d7770
pillow@10.4.0
13.0.0
1
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
pillow@11.2.1
13.0.0
1
opencsghq/csgbot:v0.6.9-ee7d0271e26521
pillow@12.1.0
13.0.0
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
pillow@11.3.0
13.0.0
1
opendatacube/ows:latest668cbb41473c
pillow@10.2.0
13.0.0
1
opendatacube/wms:latest1b90cdf68831
pillow@5.1.0
13.0.0
1
opendatacube/wps:latest80df355a660b
pillow@9.0.1
13.0.0
1
opendronemap/nodeodm:3.6.2fcd99eb23d8d
pillow@11.3.0
13.0.0
1
openmined/syft-backend:0.9.5b72f74a68b32
pillow@11.1.0
13.0.0
1
opennode/waldur-mastermind:8.1.382e8f276c5ed
pillow@12.3.0
13.0.0
1
pangeo/base-notebook:2024.01.155fbe688a4f80
pillow@10.2.0
13.0.0
1
pretix/standalone:2026.8.0ec17c2f761f7
pillow@12.3.0
13.0.0
1
prowlercloud/prowler-api:5.31.14f252d579be2
pillow@12.2.0
13.0.0
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
pillow@11.3.0
13.0.0
1
psono/psono-server:5.0.03b974b43ea03
pillow@10.3.0
13.0.0
1
rdavidoff/twitch-channel-points-miner-v2:1.8.67ae4c5135771
pillow@10.0.0
13.0.0
1
reallibrephotos/librephotos:1.2.1ecd7052f2b5f
pillow@12.3.0
13.0.0
1
redimp/otterwiki:21435c8cc536d
pillow@12.3.0
13.0.0
1
robmarkcole/deepstack-ui:latest410275726459
pillow@8.3.2
13.0.0
1
robustadev/krr:v1.30.0b8d782e568c7
pillow@12.3.0
13.0.0
1
rommapp/romm:5.2.03512f2ca4557
pillow@12.3.0
13.0.0
1
rommapp/romm:4.4.1b909e95d1aab
pillow@10.4.0
13.0.0
1
saidsef/scapy-containerised:v2025.02f17f7c435891
pillow@11.1.0
13.0.0
1
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
pillow@11.3.0
13.0.0
1
scrapinghub/splash:3.4.1a5f89bc84606
pillow@5.4.1
13.0.0
1
seafileltd/seafile-mc:9.0.106693911bcc40
pillow@9.3.0
13.0.0
1
seafileltd/seafile-mc:10.0.170628f29c663
pillow@9.3.0
13.0.0
1
seafileltd/seafile-mc:9.0.97ac833196f60
pillow@9.2.0
13.0.0
1
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
pillow@8.3.1
13.0.0
1
signalen/backend:2.50.1826bb090bc4e4
pillow@12.3.0
13.0.0
1
sirrend/helmup-engine:0.1.13699e79e3d4e2
pillow@10.4.0
13.0.0
1
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
pillow@10.3.0
13.0.0
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
pillow@11.0.0
13.0.0
1
szurubooru/server:2.5accf2ad9fbc3
pillow@11.2.1
13.0.0
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
pillow@9.4.0
13.0.0
1
taigaio/taiga-back:latest4beed8f62c9f
pillow@12.0.0
13.0.0
1
taigaio/taiga-back:6.4.29f97323cc150
pillow@8.2.0
13.0.0
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
pillow@11.1.0
13.0.0
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
pillow@5.0.0
13.0.0
1
timothyclarke/wptserver:2018-03-0840a80ced8031
pillow@2.6.1
13.0.0
1
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
pillow@12.3.0
13.0.0
1
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
pillow@12.3.0
13.0.0
1
vabene1111/recipes:2.3.50f8d061895e9
pillow@11.3.0
13.0.0
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
pillow@9.0.0
13.0.0
1
weblate/weblate:3.11.3-182848df56ecd
pillow@5.4.1
13.0.0
1
weblate/weblate:2026.10.1.1b0f200f38d70
pillow@12.3.0
13.0.0
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.