ImageMagick Ghostscript Delegate Path Hijack — Non-Standard gs Spawn or Shell (exploitarium)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

Detects potential exploitation attempts involving ImageMagick and Ghostscript. It monitors for two primary suspicious behaviors: ImageMagick spawning Ghostscript from non-standard or hijackable file paths, and Ghostscript spawning shells or common script interpreters, which is a common indicator of command injection via image processing delegates.