{"id":"GHSA-22qq-2fwx-7p67","aliases":["CVE-2026-114608"],"title":"Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME","description":"### Impact\n\nSince 2006 / pylint 0.15.2, pylint caches its stats as pickles in `PYLINT_HOME` and reload them on the next run with `pickle.load`. Someone without access to the configuration or linted code, but with access to the cache directory (predictable `PYLINT_HOME` on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache.\n\n### Patches\n\nFrom pylint 4.0.9, the result cache is now stored as JSON instead of pickle, preventing code-execution. \n\n### Workarounds\n\nUntil upgrading do not point `PYLINT_HOME` to an untrusted, shared, or group-writable directory. The default value, `~/.cache/pylint`, is writable only by the user running pylint.\n\n### Credits\n\n- Reported privately via Tidelift coordinated disclosure (Dan Lenz).","severity":"medium","score":5.4,"published":"2026-10-27T14:46:51.000Z","modified":"2026-10-27T15:00:04.526Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"PyPI","name":"pylint","ranges":[{"events":[{"introduced":"0"},{"fixed":"4.0.9"}],"type":"ECOSYSTEM"}],"versions":["0.10.0","0.11.0","0.12.1","0.13.0","0.14.0","0.15.2","0.16.0","0.18.0","0.18.1","0.19.0","0.20.0","0.21.0","0.21.1","0.21.2","0.21.3","0.22.0","0.23.0","0.24.0","0.25.0","0.25.1","0.25.2","0.26.0","0.27.0","0.28.0","0.4.1","0.6.0","0.6.1","0.7.0","0.8.1","1.0.0","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.9.0","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","2.0.0","2.0.0.dev0","2.0.0.dev1","2.0.0.dev2","2.0.1","2.1.0","2.1.1","2.10.0","2.10.1","2.10.2","2.11.0","2.11.1","2.12.0","2.12.1","2.12.2","2.13.0","2.13.1","2.13.2","2.13.3","2.13.4","2.13.5","2.13.6","2.13.7","2.13.8","2.13.9","2.14.0","2.14.0b1","2.14.1","2.14.2","2.14.3","2.14.4","2.14.5","2.15.0","2.15.10","2.15.2","2.15.3","2.15.4","2.15.5","2.15.6","2.15.7","2.15.8","2.15.9","2.16.0","2.16.0.dev0","2.16.0b0","2.16.0b1","2.16.1","2.16.2","2.16.3","2.16.4","2.17.0","2.17.1","2.17.2","2.17.3","2.17.4","2.17.5","2.17.6","2.17.7","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.0.dev0","2.3.0.dev1","2.3.0.dev2","2.3.1","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.7.0.dev1","2.7.1","2.7.1.dev1","2.7.2","2.7.3","2.7.4","2.8.0","2.8.1","2.8.1.dev1","2.8.2","2.8.3","2.9.0","2.9.0.dev1","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","3.0.0","3.0.0a0","3.0.0a1","3.0.0a3","3.0.0a4","3.0.0a5","3.0.0a6","3.0.0a7","3.0.0b0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.5a0","3.3.6","3.3.7","3.3.8","3.3.9","4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8"],"fixed":["4.0.9"]}],"references":["https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67","https://nvd.nist.gov/vuln/detail/CVE-2026-114608","https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d","https://github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77682ca","https://github.com/pylint-dev/pylint","https://github.com/pylint-dev/pylint/releases/tag/v4.0.9"],"sources":[{"name":"OSV","id":"GHSA-22qq-2fwx-7p67","modified":"2026-10-27T15:00:04.526940865Z","url":"https://osv.dev/vulnerability/GHSA-22qq-2fwx-7p67"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":5.4}]}