CVE-2026-114608
Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.
| CWE | CWE-502 |
| Vendor | pylint-dev |
| Product | pylint |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for pylint-dev pylint
Be the first to know when new unknown vulnerabilities affecting pylint-dev pylint are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
pylint-dev / pylint
< 4.0.9
References
github.com: https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67 github.com: https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d github.com: https://github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77682ca github.com: https://github.com/pylint-dev/pylint/releases/tag/v4.0.9