Repository navigation
[Bug]: Security issue in pillow dep #604
Description
What happened?
The latest version of fastembed relies on pillow < 12.0 which exposes a vulnerability.
See GHSA-cfh3-3jmp-rvhc
Please update this library so that it can work with a patched version
What is the expected behaviour?
No response
A minimal reproducible example
No response
What Python version are you on? e.g. python --version
Python3.13
FastEmbed version
v0.7.4
What os are you seeing the problem on?
No response
Activity
thomasboer-sketch commentedon Feb 12, 2026
+1 — this is blocking our publish pipeline as well.
pip-auditflagspillow 11.3.0for CVE-2026-25990 (fixed in 12.1.1), and fastembed 0.7.4 pinspillow<12.0.Note that the
mainbranch still has the<12.0upper bound too, so a release from current main wouldn't fix it.Happy to open a PR bumping the constraint if that helps.
patricklewis commentedon Feb 13, 2026
@thomasboer-sketch see #599 for a PR to allow Pillow 12
terencehonles commentedon Mar 19, 2026
my PR was superseded by #611, but it still needs to be released
thephfernandes commentedon Mar 20, 2026
@tbung any updates on the release?
Dylancouzon commentedon Jul 24, 2026
Hey @pcorpet @thomasboer-sketch @terencehonles @thephfernandes
Sorry for the delay. #611 raised the pillow bound to <13.0 and it shipped in v0.8.0, so a patched pillow resolves now.
Closing this as completed.