Added release notes

radarhere · Dec 12, 2023 · c605f12 · c605f12
1 parent 2189761
commit c605f12
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/docs/releasenotes/10.2.0.rst b/docs/releasenotes/10.2.0.rst
@@ -39,8 +39,13 @@ enums have been added to :py:class:`PIL.DdsImagePlugin`.
 Security
 ========
 
-TODO
-^^^^
+Restrict environment dictionary keys for ImageMath.eval
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+:cve:`2023-50447`: If an attacker has control over the keys passed to the
+``environment`` argument of :py:meth:`PIL.ImageMath.eval`, they may be able to execute
+arbitrary code. To prevent this, keys matching the names of builtins and keys
+containing double underscores will now raise a :py:exc:`ValueError`.
 
 TODO