CVE-2026-114608: Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pylintto a version that resolves this vulnerability.Fixed in 4.0.9
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Pylint versions from 0.15.2 through 4.0.8 are exposed when PYLINT_HOME points to a shared, group-writable, or otherwise untrusted directory. The normal per-user default cache is not normally writable by another user.
What access does an attacker need to exploit it?
An attacker needs the ability to write or replace a Pylint statistics cache file under the directory used for PYLINT_HOME. Code executes with the privileges of the user who subsequently runs Pylint and loads the crafted cache.
What should be done if upgrading cannot happen immediately?
Ensure PYLINT_HOME uses a per-user directory that is not writable by other users, and do not use shared or group-writable cache directories. Remove or distrust existing cache files in any directory that may have been writable by untrusted users.
How can I determine whether a system may already be affected?
Check whether Pylint has been run with PYLINT_HOME set to a shared, group-writable, or otherwise untrusted location, and whether untrusted users could have modified its statistics cache files. Any such cache should be treated as potentially malicious if it may be loaded by a vulnerable Pylint version.