- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 20
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://github.com/python-pillow/Pillow
Products and areas 12
- Every image plugin in the tree. JPEG, PNG, GIF, TIFF, WebP, BMP, ICO, PCX, PPM, TGA, DDS, SGI, PSD, JPEG 2000, EPS and the long tail of formats nobody remembers Pillow supports
- Format sniffing and plugin selection, where the file's contents rather than its name decide which parser runs
- ImageCms and the colour profile handling behind it
- ImageMath and ImageMorph, including the evaluation surface the policy singles out
- Resource limits, including MAX_IMAGE_PIXELS and the decompression-bomb handling the policy names by hand
- Save and encode paths, which matter because servers rewrite uploads before storing them
- Text rendering through ImageFont and FreeType, where the font file is often as attacker-controlled as the image
- The buffer-facing APIs: frombuffer, frombytes, tobytes and the array interface, where a caller's stride and mode assumptions meet Pillow's
- The decoder and encoder framework: ImageFile, tile lists, chunked reads, and the seek and tell paths that multi-frame formats such as GIF and TIFF use
- The EPS plugin and its invocation of Ghostscript, plus any other path where Pillow starts an external process on a file's behalf
- The _imaging C extension and the way Pillow drives the C libraries it links or bundles for decode and encode
- The policy takes sensitive vulnerability information privately through GitHub and identifies the parsing of untrusted image data as the primary attack surface. It carves no component out of the library, so everything below is inside the declared scope
Out of scope (6)
- Applications that deliberately raise or disable MAX_IMAGE_PIXELS and then run out of memory, which is the operator's decision
- Defects inside an upstream library such as libjpeg-turbo, zlib or libtiff that Pillow merely calls, unless Pillow's use of it is what makes the defect reachable
- Downstream wrappers and frameworks that call Pillow, including Django's image handling
- Public GitHub issues used to report an unfixed security defect, which the policy asks you not to do
- Python interpreter and standard library bugs
- The original PIL, which is unmaintained and is a different codebase
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report privately on GitHub at github.com/python-pillow/Pillow/security/advisories/new
-
Read the threat model in the policy before filing.
-
Attach the file and the three lines of Python that reproduce it, including the Pillow version and whether the wheel or a source build was used
-
Say which plugin handled the file.
-
Show the defect in Pillow's own code or in how Pillow drives a bundled library.
Not accepted
-
Defects inside an upstream library such as libjpeg-turbo, zlib or libtiff that Pillow merely calls
-
The original PIL, which is unmaintained and is a different codebase
-
Applications that deliberately raise or disable MAX_IMAGE_PIXELS and then run out of memory
-
Python interpreter and standard library bugs
-
Downstream wrappers and frameworks that call Pillow, including Django's image handling
-
Public GitHub issues used to report an unfixed security defect
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 20 CVEs, 19 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 19 Last 12 months 20 Lifetime Memory safety in bundled codecs 40 % Decompression bomb / exhaustion 25 % Code execution paths 20 % Parsing and validation 15 % Latest advisories Loading the feed Overview Pillow is the imaging library Python actually uses. It is one of the most-downloaded packages on PyPI and sits in the upload path of a very large share of Django and Flask applications, thumbnailing whatever a user hands them. The project's own policy is unusually direct about the risk: the exposed surface is parsing image data from strangers, running from decompression bombs to the memory safety of the C decoders Pillow bundles. Twenty advisories have been published against it. The security process is mature and there is still no money in it. Tidelift funds maintenance rather than findings, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy takes sensitive vulnerability information privately through GitHub and identifies the parsing of untrusted image data as the primary attack surface. It carves no component out of the library, so everything below is inside the declared scope Every image plugin in the tree. JPEG, PNG, GIF, TIFF, WebP, BMP, ICO, PCX, PPM, TGA, DDS, SGI, PSD, JPEG 2000, EPS and the long tail of formats nobody remembers Pillow supports Format sniffing and plugin selection, where the file's contents rather than its name decide which parser runs The _imaging C extension and the way Pillow drives the C libraries it links or bundles for decode and encode The decoder and encoder framework: ImageFile , tile lists, chunked reads, and the seek and tell paths that multi-frame formats such as GIF and TIFF use Resource limits, including MAX_IMAGE_PIXELS and the decompression-bomb handling the policy names by hand ImageMath and ImageMorph , including the evaluation surface the policy singles out The EPS plugin and its invocation of Ghostscript, plus any other path where Pillow starts an external process on a file's behalf Text rendering through ImageFont and FreeType, where the font file is often as attacker-controlled as the image ImageCms and the colour profile handling behind it The buffer-facing APIs: frombuffer , frombytes , tobytes and the array interface, where a caller's stride and mode assumptions meet Pillow's Save and encode paths, which matter because servers rewrite uploads before storing them Out of scope Defects inside an upstream library such as libjpeg-turbo, zlib or libtiff that Pillow merely calls, unless Pillow's use of it is what makes the defect reachable The original PIL, which is unmaintained and is a different codebase Applications that deliberately raise or disable MAX_IMAGE_PIXELS and then run out of memory, which is the operator's decision Python interpreter and standard library bugs Downstream wrappers and frameworks that call Pillow, including Django's image handling Public GitHub issues used to report an unfixed security defect, which the policy asks you not to do Most-valued findings Memory corruption in the C decode path reachable from Image.open and a load() , with no unusual API use, since that is the exact shape of a web upload handler Anything that turns image parsing into code execution, whether through the EPS route into Ghostscript or through an evaluation path reached with attacker-controlled input Integer overflow in dimension, stride or tile arithmetic before allocation, where a header that passes validation produces an undersized buffer Bugs in the seek and tell handling of multi-frame formats, where frame counts and offsets come straight from the file Resource exhaustion that beats the documented MAX_IMAGE_PIXELS guard, since the policy treats decompression bombs as a class it already thought about and a bypass is a real finding Out-of-bounds reads that land in the saved output, because a thumbnailing service hands the leaked bytes straight back to the attacker Format sniffing that routes a file to a plugin the application never expected to invoke, which turns a JPEG-only upload form into an entry point for the whole plugin set Defects in the newer or less-travelled plugins, which get a fraction of the fuzzing that JPEG and PNG receive while being just as reachable Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately on GitHub at github.com/python-pillow/Pillow/security/advisories/new, which is what SECURITY.md asks for Tidelift is the documented fallback if you cannot use GitHub. It coordinates the fix and the disclosure; it pays maintainers for maintenance, so there is no reward to negotiate through it Read the threat model in the policy before filing. It already names decompression bombs, the EPS path, ImageMath.unsafe_eval() and bundled C library memory safety, so a report in those areas needs to show impact beyond the documented behaviour Attach the file and the three lines of Python that reproduce it, including the Pillow version and whether the wheel or a source build was used Say which plugin handled the file. Pillow sniffs the format rather than trusting the extension, so name the plugin the input actually reached Show the defect in Pillow's own code or in how Pillow drives a bundled library. A bug purely inside upstream libjpeg-turbo or zlib belongs to that project Disclosure Coordinated privately on GitHub and published as a GitHub Security Advisory with a release, with Tidelift available as the alternative coordination path. Twenty advisories are on record, and the project ships on a predictable release cadence, so expect publication to be timed to the next release. The policy documents the process and the threat model in detail without committing to a fixed embargo length, so agree the date in the advisory thread. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability