[GHSA-5xmw-vc9v-4wf2] Pillow has a heap buffer overflow with nested list coordinates

[ranjiGT]

Updates

• CVSS v3
• References

Comments
Adds the upstream fix commit for this vulnerability.

The commit "Reject non-numeric elements inside list coords (#9526)" validates coordinate lists to contain exactly two numeric coordinates and is included in 12.2.0, the patched version already listed by this advisory.

[github]

Hi there @aclark4life! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

🟢 Approval recommended

The advisory remains valid JSON, and the added commit correctly fixes the vulnerability and is included in the listed patched release.

0 open findings

What changed in this PR

Updates the Pillow vulnerability advisory with current severity metadata and the upstream fix reference.

Changes:

• Removes the CVSS v3 severity entry.
• Adds the verified fixing commit included in Pillow 12.2.0.

File	Description
GHSA-5xmw-vc9v-4wf2.json	Updates severity metadata and references the upstream fix.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github]

Hi there @aclark4life! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[aclark4life]

The description says this adds the fix commit, but the diff adds the release notes link instead. Both are fine. The fix is python-pillow/Pillow@cf6de8c (first released in 12.2.0) if you want to include it. We don't object to dropping NVD's CVSS v3 vector; the remaining v4 score is the one published with the CVE.

[ranjiGT]

Follow-up: Upstream Pillow Security Fix Reference

Thank you, @aclark4life, for the clarification and for identifying the upstream security fix.

The fix commit associated with Pillow 12.2.0 is:

• Upstream fix commit: python-pillow/Pillow@cf6de8c
• Release notes: https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

I have prepared the additional reference locally. However, the PR's head branch is hosted under github/advisory-database, where I do not have direct push permissions.

Request to maintainers: Could you please incorporate the upstream fix commit reference into the existing advisory update?

Thank you also for confirming that removing the NVD CVSS v3 vector while retaining the published CVSS v4 score is acceptable.

Thanks for your review and guidance!

[aclark4life]

Thanks. Neither of us can push to this branch; the curation team can add the commit reference when merging if they agree, or you can suggest it via https://github.com/advisories/GHSA-5xmw-vc9v-4wf2/improve. Either way, this PR looks fine to us as it stands.

[ranjiGT]

Hi @taladrane,

Could you please have a look :)

Thank you