merge: fix/pillow-cve-2026-10-21-batch3 — accept CVE-2026-112393/-112396 (pillow 12.3.0 TIFF encoding) until 2026-11-20 (project lead, 2026-10-21); addendum says 24; 245 passed

docs/security/addendum-knowledge-specialist.md

@@ -88,7 +88,7 @@ added to the Network Firewall domain allow-list the review already describes for
   is share-alike, so a redistributed table built from ChEMBL rows must carry the same licence [`config/sources.yaml`].
 - **Development.** The same enforced pre-push gate as the other repositories: pip-audit over the full 119-package
   lock, bandit, gitleaks over the tree and full history, and an SBOM [`scripts/security_scan.sh`]. One accepted
-  finding set, shared with the rest of the fleet, is documented and expires on 2026-11-20: 22 pillow 12.3.0
+  finding set, shared with the rest of the fleet, is documented and expires on 2026-11-20: 24 pillow 12.3.0
   advisories that gradio's own version constraint prevents fixing, none reachable here because the Space never
   decodes an image a caller supplies [`security/ACCEPTED-FINDINGS.md` §1; `security/accepted-vulns.txt`].
 - **The vendor's own posture.** ToolUniverse states that it operates no servers and collects no telemetry; a lookup's

security/ACCEPTED-FINDINGS.md

@@ -37,3 +37,13 @@ transitive of that kind is a reviewed change, not a silent one.
 | **Why not fixed** | Unchanged: every gradio release through 6.30.0 requires `pillow<13`. |
 | **Decision** | The project lead, 2026-10-21, when this batch blocked the first prod promotion: accept by id, same expiry, all six repos that carry the mechanism. A further batch blocks again and goes back to her. |
 | **Ends** | As batch 1: 2026-11-20, or when a gradio release allowing `pillow>=13` is pinned. |
+
+## 2026-10-21 (evening) — pillow 12.3.0: 2 more advisories ACCEPTED until 2026-11-20 (batch 3)
+
+| | |
+|---|---|
+| **Advisories** | CVE-2026-112393 (GHSA-332p-7hrc-92wf, heap buffer overflow in `_tiffWriteProc` when saving TIFF to an in-memory buffer) and CVE-2026-112396 (GHSA-4rr5-89j8-mwwm, use-after-free when encoding TIFF to an in-memory buffer) — reached PyPI's advisory feed 2026-10-21 ~21:25 UTC, after batch 2; both fixed only in pillow 13.0.0. 24 pillow 12.3.0 advisories are now accepted here. |
+| **Why acceptable** | Both need the application to ENCODE a TIFF; this Space creates, renders and saves no image of any kind. The exposure statement of batch 1 above holds unchanged. |
+| **Why not fixed** | Unchanged: every gradio release through 6.30.0 requires `pillow<13`. |
+| **Decision** | The project lead, 2026-10-21, when this batch blocked the first dev-Space push (s3): accept by id, same expiry, in this repo. The other Space repos meet the same two ids at their next push. |
+| **Ends** | As batch 1: 2026-11-20, or when a gradio release allowing `pillow>=13` is pinned. |

security/accepted-vulns.txt

@@ -26,3 +26,6 @@ CVE-2026-112894 expires=2026-11-20 pillow 12.3.0
 CVE-2026-112406 expires=2026-11-20 pillow 12.3.0
 CVE-2026-112399 expires=2026-11-20 pillow 12.3.0
 CVE-2026-112892 expires=2026-11-20 pillow 12.3.0
+# Batch 3: 2 more (TIFF encoding) published 2026-10-21, accepted by the project lead the same day (same expiry).
+CVE-2026-112393 expires=2026-11-20 pillow 12.3.0
+CVE-2026-112396 expires=2026-11-20 pillow 12.3.0