CVE-2026-114608: Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
Impact
Since 2006 / pylint 0.15.2, pylint caches its stats as pickles in PYLINTHOME and reload them on the next run with pickle.load. Someone without access to the configuration or linted code, but with access to the cache directory (predictable PYLINTHOME on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache.
Patches
From pylint 4.0.9, the result cache is now stored as JSON instead of pickle, preventing code-execution.
Workarounds
Until upgrading do not point PYLINTHOME to an untrusted, shared, or group-writable directory. The default value, ~/.cache/pylint, is writable only by the user running pylint.
Credits
- Reported privately via Tidelift coordinated disclosure (Dan Lenz).
Other sources
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pylintto a version that resolves this vulnerability.Fixed in 4.0.9 - Upgrade
Upgrade
debian/pylintto a version that resolves this vulnerability.Fixed in 4.0.9-1 - Upgrade
Upgrade
pylintto a version that resolves this vulnerability.Fixed in 4.0.9 - Configuration
Do not point PYLINT_HOME to an untrusted, shared, or group-writable directory.
Pylint PYLINT_HOME = a trusted, user-only-writable directory
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Pylint versions from 0.15.2 through 4.0.8 are exposed when PYLINT_HOME points to a shared, group-writable, or otherwise untrusted directory. The normal per-user default cache is not normally writable by another user.
What access does an attacker need to exploit it?
An attacker needs the ability to write or replace a Pylint statistics cache file under the directory used for PYLINT_HOME. Code executes with the privileges of the user who subsequently runs Pylint and loads the crafted cache.
What should be done if upgrading cannot happen immediately?
Ensure PYLINT_HOME uses a per-user directory that is not writable by other users, and do not use shared or group-writable cache directories. Remove or distrust existing cache files in any directory that may have been writable by untrusted users.
How can I determine whether a system may already be affected?
Check whether Pylint has been run with PYLINT_HOME set to a shared, group-writable, or otherwise untrusted location, and whether untrusted users could have modified its statistics cache files. Any such cache should be treated as potentially malicious if it may be loaded by a vulnerable Pylint version.