ann/requirements.txt pins Pillow==9.2.0. Pillow <10.0.1 bundles a libwebp affected by CVE-2023-4863 — heap buffer overflow in libwebp's BuildHuffmanTable yielding RCE on crafted WebP input (advisory GHSA-j7hp-h8jx-5ppr).
CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2023-09-13; originally exploited as a Chrome 0-day, same library code ships inside Pillow's manylinux wheels.
Risk surface: anyone pip-installing from this requirements file gets a Pillow that can be made to RCE by decoding attacker-supplied imagery (research dataset ingest, notebooks fed by user upload, etc.).
Suggested fix:
- Pillow==9.2.0
+ Pillow>=10.0.1
Happy to send a PR.
Found via public-data scan on 2026-05-19; no infrastructure was tested.
ann/requirements.txtpinsPillow==9.2.0. Pillow<10.0.1bundles a libwebp affected by CVE-2023-4863 — heap buffer overflow in libwebp'sBuildHuffmanTableyielding RCE on crafted WebP input (advisory GHSA-j7hp-h8jx-5ppr).CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2023-09-13; originally exploited as a Chrome 0-day, same library code ships inside Pillow's manylinux wheels.
Risk surface: anyone pip-installing from this requirements file gets a Pillow that can be made to RCE by decoding attacker-supplied imagery (research dataset ingest, notebooks fed by user upload, etc.).
Suggested fix:
Happy to send a PR.
Found via public-data scan on 2026-05-19; no infrastructure was tested.