CLEANSTART-2026-PN23399: Pillow is a Python imaging library

Q: What access does an attacker need to exploit this issue?

The severity vector indicates that the issue is exploitable over the network with low attack complexity. It requires no privileges and no user interaction.

Q: What is the potential impact if exploitation succeeds?

The reported vector rates confidentiality, integrity, and availability impact as high. The vulnerability is rated critical with a 9.8 severity score.

Q: Which deployments should be prioritized for investigation?

Deployments using the cleanstart/apache-superset software package should be prioritized, particularly where the application is reachable over the network. The provided data does not identify affected versions or configuration prerequisites.

Published Nov 5, 2026

Updated

Security vulnerability affects the apache-superset package. Pillow is a Python imaging library.

Affected Software

2 affected componentsFixes available

cleanstart/apache-superset<2021.36.5-r0

2021.36.5-r0

cleanstart/apache-superset<2021.38.2-r0

2021.38.2-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/apache-superset to a version that resolves this vulnerability.
Fixed in 2021.36.5-r0
Upgrade
Upgrade cleanstart/apache-superset to a version that resolves this vulnerability.
Fixed in 2021.38.2-r0

Event History

Nov 5, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-96639

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The severity vector indicates that the issue is exploitable over the network with low attack complexity. It requires no privileges and no user interaction.

What is the potential impact if exploitation succeeds?

The reported vector rates confidentiality, integrity, and availability impact as high. The vulnerability is rated critical with a 9.8 severity score.

Which deployments should be prioritized for investigation?

Deployments using the cleanstart/apache-superset software package should be prioritized, particularly where the application is reachable over the network. The provided data does not identify affected versions or configuration prerequisites.

CLEANSTART-2026-PN23399: Pillow is a Python imaging library

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which deployments should be prioritized for investigation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which deployments should be prioritized for investigation?