AZL-110543: CVE-2026-114608 affecting package pylint 4.0.2-2

Q: Who is realistically exposed to this issue?

Users are exposed when Pylint uses a shared, group-writable, or otherwise untrusted directory for PYLINT_HOME. The default per-user cache is not normally writable by another user, so it is not normally exposed to another local user tampering with cache files.

Q: What does an attacker need to exploit it?

An attacker needs the ability to write or replace Pylint's statistics cache files in the directory used for PYLINT_HOME. A user must then run Pylint, which loads the crafted cache using pickle.load.

Q: What is the impact if exploitation succeeds?

Crafted serialized cache data can cause arbitrary code execution. The code runs with the privileges of the user who subsequently runs Pylint.

Q: What can be done if updating is not immediately possible?

Ensure PYLINT_HOME points to a per-user directory that is not writable by other users. Do not use shared, group-writable, or otherwise untrusted directories for Pylint cache storage.

Q: Which versions are affected and fixed?

Pylint versions from 0.15.2 through 4.0.8 are affected. The issue is fixed in version 4.0.9.

Published Oct 22, 2026

Updated

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.

Affected Software

1 affected component

azure-linux/pylint<=4.0.2-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pylint to a version that resolves this vulnerability.
Fixed in 4.0.9

Event History

Oct 22, 2026

Advisory Published

via OSV·05:16 PM

Data Sourced

via OSV·05:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114608

Frequently Asked Questions

Who is realistically exposed to this issue?

Users are exposed when Pylint uses a shared, group-writable, or otherwise untrusted directory for PYLINT_HOME. The default per-user cache is not normally writable by another user, so it is not normally exposed to another local user tampering with cache files.

What does an attacker need to exploit it?

An attacker needs the ability to write or replace Pylint's statistics cache files in the directory used for PYLINT_HOME. A user must then run Pylint, which loads the crafted cache using pickle.load.

What is the impact if exploitation succeeds?

Crafted serialized cache data can cause arbitrary code execution. The code runs with the privileges of the user who subsequently runs Pylint.

What can be done if updating is not immediately possible?

Ensure PYLINT_HOME points to a per-user directory that is not writable by other users. Do not use shared, group-writable, or otherwise untrusted directories for Pylint cache storage.

Which versions are affected and fixed?

Pylint versions from 0.15.2 through 4.0.8 are affected. The issue is fixed in version 4.0.9.

AZL-110543: CVE-2026-114608 affecting package pylint 4.0.2-2

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

What is the impact if exploitation succeeds?

What can be done if updating is not immediately possible?

Which versions are affected and fixed?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

What is the impact if exploitation succeeds?

What can be done if updating is not immediately possible?

Which versions are affected and fixed?