{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f1405672-d44c-50bb-89a0-568095761a2e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare", "version": "11.3.0.post5+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.3.0", "type": "library", "version": "11.3.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:fa296563-7e6c-5d1a-b0f9-6497ac146b48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:4cba6a0d-0b51-543b-8824-594c33302ab8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:72f3f067-254a-5071-a1f6-8ef832ceb1c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:1d93b1f2-aaee-52c7-a999-cd8adefa3bff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:d067d9d2-08f5-564f-941b-a23d3c92865d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:a70756c2-d267-5a78-96ce-dc07b5780081", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112396", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:8971f2f6-17af-5084-a6db-fbd0c21d45de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112396 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:44a09831-4a23-5593-a131-098a62c7fa37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:8d0fd208-041a-5835-ac86-f3f8e1070905", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:209ee25b-123b-5ba7-879a-b0e1e3d3b770", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:06f9dcfc-957b-5321-b9ad-7f5b0ecfb6b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112400 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:473f02d0-868c-5389-be31-4b58460c82d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:e3a9cfbb-8892-57d8-a74f-3338e03edde1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:42e00a12-6632-5718-b4ca-3b40a404867b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:1555901e-c4fa-53a9-baf7-2a063a67a0e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:9ff75c6e-b7fc-5bee-abdc-539ca36c78f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:53473ddd-fab0-580f-9361-337202eaac9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:73318dea-a3be-5e1e-8b52-351070f121b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:4c2690fe-783b-5055-993b-ab106ae642b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112893 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:90ce1e9e-b79c-5214-819f-fb2cc810009a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:a4ea7140-1916-59bb-9ded-17d594f2fbb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:81153435-2bb0-5319-a7b3-014373deb9de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:606b6f56-7cee-5ef6-85f4-16079c5c6249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:f1f7503a-e601-562a-9298-d12ceac87c19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:61402a18-8001-5c73-b741-3d83f197132a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:3958e2e9-8c20-5695-8907-55f6d4c5f922", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:d42d7db8-7138-53b7-b019-057fa2080fe9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:1dacd7b8-3e86-5eb6-9863-4923419b3e54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:3205bd25-90be-5692-bba6-2e8504a4f4ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:4334ca92-c485-5b8a-b6d4-16031407fd5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:8114a35b-c732-5a62-b2ff-6ec13b0e1255", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:b8bcee29-358e-5789-842b-2e35c6470e7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:57e987fe-bb9d-5464-a615-f4e6b32129d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42309 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post6+tuxcare." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:11341214-2655-584e-8f80-e92b8fd3d93e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:d01b2c4d-3aef-5960-b1d6-93c79606ad54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:fc52013d-cd37-521e-8185-f328e59115a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:11cca86e-64a5-599e-a773-9576f0ac75f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:9e6993c3-66a9-55e3-9caf-7f64e6712cac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:deecfdf8-e752-51c7-9907-199f85e501ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:bbb5f793-98b8-5fd4-9ec3-f76102fafb95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:6712ca00-1e19-5c3f-bf0b-bebbe597f7cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:495ff498-67c7-54e2-8349-56ed85dde045", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:f27f7289-1ff2-5a2d-913a-17ddde386571", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:6d3378ea-32d1-5229-bc61-d2073a7e8dc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:4a23e3b3-9cb4-546e-a366-9c42887a2d4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:fb3f1df5-e548-5a82-ab66-4019ed78c1d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:0072d7a5-575e-5068-9449-4bde59fd550f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:a69e9994-40a5-525e-bac5-a067448a21f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:eb174942-be26-5abc-97fd-a998ee4df969", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:77244833-fc5c-5a1b-a9a0-86319ba0028c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:e018a55f-1808-53f5-8ede-a241ca291f92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96639 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:34b715ac-d262-5b7f-999e-d383f54ce1ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:df8a2309-5826-5fb5-a249-a11eddf80d52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.3.0.post5+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:6314f46a-57ab-51b0-a68d-8f56a9b0423a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:a20f2d51-9e6b-5864-8c71-562008d4dec5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96643 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:0da2dba4-92f8-5ad3-afdb-05a1ce4f2d01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:5ca22702-6bf5-5477-8aed-e29a0e1efd0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 11.3.0.post5+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ], "bom-ref": "urn:uuid:0548f43e-0555-575d-8b0f-e7c42ef59614", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post5+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.3.0.post5+tuxcare" } ] }