{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:57be8999-b311-55ae-9b42-61440d21b8d5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "type": "library", "bom-ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare", "version": "11.3.0.post6+tuxcare", "pedigree": { "ancestors": [ { "name": "pillow", "purl": "pkg:pypi/pillow@11.3.0", "type": "library", "version": "11.3.0" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-112390", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:a5235d4b-5efe-5b1c-bb1c-94b93e4c12b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112390 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112391", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:99bd5f34-a211-595b-8593-9e00f16503e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112391 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112392", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:7954f01b-d504-5366-b5b0-3642226b9915", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112392 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112393", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:ee8f0634-c03c-5d10-a245-cca4c04cc215", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112393 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112394", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:17af830b-7a81-5026-bffd-41da163517bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112394 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112395", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:24701cbc-117a-5a85-b2b2-e91c69602222", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112395 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112396", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:9b6bcf28-1281-5b3c-b8ab-e2525ae155f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112396 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112397", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:4c72c354-d0b8-5ef3-b569-7638aa6add8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112397 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112398", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:ae1e76f1-23b4-5e1c-8263-e78e3d10793a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112398 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112399", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:f164348f-5756-5804-b097-e8dab68a5790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112399 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112400", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:15600eec-3759-5f27-b6dc-1206dea891fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112400 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112401", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:888630d5-1820-5e70-aeaa-7de46068624d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112401 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112402", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:65701ed4-b21e-5d11-8aea-6b8ab63fe5d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112402 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112403", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:011f15df-29d6-5900-b1a3-8c061a959d71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112403 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112404", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:9d4bd896-3f36-5ffe-8204-bd8704aaf025", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112404 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112406", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:c669513d-3c61-54c4-9deb-fab109e68c4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112406 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112891", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:015c86b7-87c1-516d-980f-ff7493229202", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112891 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112892", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:76f8f1d2-790c-582a-95a9-5f30690e92fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112892 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112893", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:f3125266-a04e-562a-bb44-061cc503b6be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112893 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112894", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:be525d79-e39d-5bee-805d-a60ca7fb7b6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112894 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112895", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:8503a778-84d5-5a45-8d8f-03af9bf468a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112895 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112896", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:1efb5fd6-ccbd-59ae-8807-880305965e36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112896 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112897", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:227ce3f8-0754-5258-929a-705710102ed9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112897 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112898", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:a75beb05-821f-5666-9ab0-271e0a1f4c49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112898 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112899", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:4c2e29a0-a16f-56d6-a3d1-f3c4492e7e63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112899 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-112900", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:051a2d4f-aa4b-5522-b5be-db0b2564ce9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112900 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post8+tuxcare." } }, { "id": "CVE-2026-112901", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:702d8889-7833-51cd-8f4c-823bc127b923", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112901 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-112902", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:6b41d8ac-a4b6-5685-bb7f-b4a7d1f39735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-112902 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-114501", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:b181637b-58a5-5504-ba39-c139642c9347", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114501 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-25990", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:e25772ce-da12-50de-90de-7e3f0b193a11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25990 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-40192", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:1193f723-365a-5b1e-afb9-a0343a1d8a30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40192 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-42308", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:ef295319-3b3c-5834-9ff8-93b47346dda1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42308 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-42309", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:487777b2-67c8-5a22-994d-511ce3927677", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42309 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-42310", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:6d9ef5ce-bc43-5c37-b42f-b43287e1ec75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42310 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-42311", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:c31769fe-1e99-5907-8e80-036a3b8b82f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42311 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-54058", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:d8cb099d-adf5-54ce-add3-04640086fc66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54058 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-54059", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:8f1a68a0-ea77-5fc8-b0ca-6c6001580884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54059 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-54060", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:bfdfb840-d692-5162-93e0-96132c77bbd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-54060 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-55379", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:73ab77e0-9c3f-515d-a25d-dbc41b80177c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55379 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-55380", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:48ef438e-4c60-5d2e-a0bc-ff9f0b3eaedc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55380 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-55798", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:36cb793a-97d7-5969-9e64-0460d98e85f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-55798 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59197", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:5f836b71-ac8f-5cf0-81d7-d23c94fc7ced", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59197 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59198", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:0354e99d-cdc8-5b86-aa82-bf702eeb10fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59198 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59199", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:33f59c97-15bc-5cba-a314-bfa3a8dda3d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59199 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59200", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:55eeea3c-d680-5fb4-bfdf-26fc4283d789", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59200 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59204", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:6d393d62-251a-5747-91cc-bad354eb59e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59204 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-59205", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:4d21b6e4-bc10-5543-a3e9-cdc00226f612", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59205 is fixed in version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96636", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:99343492-1cd2-55b5-9ed0-25092f8d49d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96636 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96637", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:1c9d1441-2b41-55f4-acad-4b58030d5f8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96637 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96638", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:b15b2718-4a94-5a8f-9077-45adb5770e83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96638 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96639", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:7d5024fd-63f8-5d65-8fcd-5d1e56eeca55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96639 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96640", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:59a0a60d-4dd9-53b4-97c3-c766f195a7a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96640 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post7+tuxcare." } }, { "id": "CVE-2026-96641", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:900cc086-466f-572f-a4bf-8c79d524223a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96641 affects version 11.3.0.post6+tuxcare of pillow." } }, { "id": "CVE-2026-96642", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:4a7ab9f3-d05a-55a4-a9ec-6c61e5a0d4dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96642 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96643", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:cf4ec077-9878-5255-a7a5-dd2f0fb781ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96643 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96644", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:095ba3c8-0983-5c69-b0e4-0cdb0023bba1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96644 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "CVE-2026-96778", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:d31449b5-3231-5e70-a9ce-4efd5b10ab03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-96778 affects version 11.3.0.post6+tuxcare of pillow, and is fixed in 11.3.0.post9+tuxcare." } }, { "id": "GHSA-78g4-xqwv-q3g8", "affects": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ], "bom-ref": "urn:uuid:53bcf0a3-ecc8-5b60-a416-7abbbddc75b6", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-78g4-xqwv-q3g8 does not affect version 11.3.0.post6+tuxcare of pillow. not_affected \u2014 Pillow 11.3.0 source repository is not_affected by GHSA-78g4-xqwv-q3g8. The vulnerability exists in OpenJPEG 2.5.3 (specifically in src/lib/openjp2/j2k.c function opj_j2k_read_sod), which is a build-time dependency downloaded during wheel construction. The vulnerable OpenJPEG source code is NOT present in Pillow's source repository\u2014only a dependency declaration exists in .github/workflows/wheel...", "justification": "requires_dependency" } } ], "dependencies": [ { "ref": "pkg:pypi/pillow@11.3.0.post6+tuxcare" } ] }