Update docs/handbook/security.rst

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>
This commit is contained in:
Jeffrey 'Alex' Clark 2026-04-21 11:33:48 -04:00 committed by GitHub
parent 5af49b380e
commit d3b73ea462
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -190,6 +190,7 @@ provide a stable public API for unregistering individual format plugins, so do
not rely on mutating internal registries such as ``Image.OPEN`` as a security
control.
**E-3 — ``ImageMath.unsafe_eval()`` code injection**
:py:meth:`~PIL.ImageMath.unsafe_eval` calls Python's built-in ``eval()`` with