PYSEC-2023-175
No scoreFix available
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.
What each source reports
OSVNo score
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.
- Record
PYSEC-2023-175- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pillowPyPI | before 10.0.1, plus listed versions 1.01.11.21.31.4 Show 45 moreShow less1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.810.0.02.0.02.1.02.2.02.2.12.2.22.3.02.3.12.3.22.4.02.5.02.5.12.5.22.5.32.6.02.6.12.6.22.7.02.8.02.8.12.8.22.9.03.0.03.1.03.1.0.rc13.1.0rc13.1.13.1.23.2.03.3.03.3.13.3.23.3.33.4.0 | 10.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
PYSEC-2023-175 is a vulnerability with no CVSS score yet in pillow, published September 20, 2023. No source lists public exploit code. Fixed in pillow 10.0.1.
References
This page doesn't list everything
Left out here: 43 versions. The JSON record has them.