CVE-2023-50447: 
Python vulnerability analysis and mitigation

CVE-2023-50447 affects Pillow through version 10.1.0, a popular Python imaging library. The vulnerability allows arbitrary code execution via the environment parameter in PIL.ImageMath.eval function, distinct from the previously identified CVE-2022-22817 which involved the expression parameter (NVD, Checkmarx).

The vulnerability exists in the PIL.ImageMath.eval function's environment parameter validation. The issue stems from insufficient filtering of environment keys that could potentially contain names matching Python builtins or containing double underscores, enabling arbitrary code execution. The vulnerability has a CVSS v3.1 base score of 8.1 (HIGH) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD, Researcher Blog).

If an attacker has control over the keys passed to the environment argument of PIL.ImageMath.eval(), they can potentially execute arbitrary code on the target system. This could lead to complete system compromise, affecting the confidentiality, integrity, and availability of the system (Checkmarx).

The vulnerability has been fixed in Pillow version 10.2.0. The fix implements validation that raises a ValueError for keys matching the names of builtins and keys containing double underscores. Users are strongly recommended to upgrade to version 10.2.0 or later (Pillow Release).

The vulnerability was discovered during Checkmarx's Research Group routine security assessments of open-source technologies. The Pillow maintainers responded efficiently to the report and implemented a fix, which was acknowledged by the security researcher (Researcher Blog).