From d3b73ea4628368e369bf653ca80c36a61ce485aa Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Tue, 21 Apr 2026 11:33:48 -0400 Subject: [PATCH] Update docs/handbook/security.rst Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com> --- docs/handbook/security.rst | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/handbook/security.rst b/docs/handbook/security.rst index 34ce3e30f..208afb287 100644 --- a/docs/handbook/security.rst +++ b/docs/handbook/security.rst @@ -190,6 +190,7 @@ provide a stable public API for unregistering individual format plugins, so do not rely on mutating internal registries such as ``Image.OPEN`` as a security control. + **E-3 — ``ImageMath.unsafe_eval()`` code injection** :py:meth:`~PIL.ImageMath.unsafe_eval` calls Python's built-in ``eval()`` with