Skip to content

Update dependency pillow to v12.2.0 [SECURITY] #249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mishushakov merged 1 commit into from
Apr 15, 2026
Merged

Update dependency pillow to v12.2.0 [SECURITY] #249

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion template/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
orjson==3.11.7
pandas==2.2.3
matplotlib==3.10.8
pillow==12.1.1
pillow==12.2.0

Check failure on line 9 in template/requirements.txt

View check run for this annotation

Claude / Claude Code Review

Security fix incomplete: chart_data_extractor/poetry.lock still pins vulnerable Pillow 12.1.1 

This PR fixes CVE-2026-40192 in `template/requirements.txt` by upgrading Pillow to 12.2.0, but `chart_data_extractor/poetry.lock` still pins Pillow at 12.1.1 (line 599), leaving that environment exposed to the same FITS decompression bomb vulnerability. Run `poetry update pillow` in `chart_data_extractor/` and commit the updated lock file to complete the fix.

@claude claude Bot Apr 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 This PR fixes CVE-2026-40192 in template/requirements.txt by upgrading Pillow to 12.2.0, but chart_data_extractor/poetry.lock still pins Pillow at 12.1.1 (line 599), leaving that environment exposed to the same FITS decompression bomb vulnerability. Run poetry update pillow in chart_data_extractor/ and commit the updated lock file to complete the fix.

Extended reasoning...

Incomplete security fix: chart_data_extractor/poetry.lock still pins Pillow 12.1.1

This PR correctly updates template/requirements.txt to pillow==12.2.0 to patch CVE-2026-40192, which allows a specially crafted FITS image to trigger unbounded GZIP decompression, leading to OOM denial-of-service. However, the repository contains a second Pillow installation path that was not updated: chart_data_extractor/poetry.lock.

Affected code path: In chart_data_extractor/poetry.lock (lines 598–603), the lock file resolves Pillow to version 12.1.1 with optional = false and groups = ["main"]. This means Pillow is a non-optional, main-group dependency that is unconditionally installed by poetry install. Pillow arrives as a transitive dependency of matplotlib (which pyproject.toml lists as a direct dependency), and the lock file explicitly pins it to the vulnerable version.

Why existing checks don't catch it: The PR diff only touches template/requirements.txt. Poetry lock files are not automatically updated when a requirements.txt in a sibling directory is changed; each directory with a pyproject.toml/poetry.lock pair is managed independently. The CI workflow .github/workflows/charts_tests.yml runs poetry install in chart_data_extractor/, so every CI build for that component installs the vulnerable Pillow 12.1.1.

Impact: Any developer or CI pipeline that runs poetry install in chart_data_extractor/ will install Pillow 12.1.1 and remain exposed to CVE-2026-40192. While chart_data_extractor itself may not directly process FITS images, Pillow is present in the environment and could be exercised by upstream code, tests, or future changes.

Step-by-step proof:

  1. A developer clones the repo and runs poetry install in chart_data_extractor/.
  2. Poetry reads chart_data_extractor/poetry.lock and installs pillow==12.1.1 (line 599) because optional = false and it is in the main group.
  3. The installed Pillow is the vulnerable 12.1.1, not the patched 12.2.0.
  4. An attacker can supply a crafted FITS file to any code path that invokes PIL.Image.open(), triggering unbounded memory consumption.

Fix: Run poetry update pillow (or poetry lock --no-update after manually editing pyproject.toml to constrain the version) inside chart_data_extractor/, then commit the updated poetry.lock as part of this PR.


# Latest version for
e2b_charts
Expand Down
Loading