OESA-2026-4699: pylint security update
Pylint is a Python source code analyzer which looks for programming errors, helps enforcing a coding standard and sniffs for some code smells (as defined in Martin Fowler's Refactoring book). Pylint can be seen as another PyChecker since nearly all tests you can do with PyChecker can also be done with Pylint. However, Pylint offers some more features, like checking length of lines of code, checking if variable names are well-formed according to your coding standard, or checking if declared interfaces are truly implemented, and much more. Additionally, it is possible to write plugins to add your own checks. Security Fix(es):
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.(CVE-2026-114608)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/pylintto a version that resolves this vulnerability.Fixed in 2.12.2-3.oe2203sp4 - Upgrade
Upgrade
Pylintto a version that resolves this vulnerability.Fixed in 4.0.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running Pylint versions from 0.15.2 through 4.0.8 are exposed when PYLINT_HOME points to a shared, group-writable, or otherwise untrusted cache directory. The default per-user cache is not normally writable by another user.
What does an attacker need to exploit it?
An attacker needs the ability to write or replace Pylint module-statistics cache files in the directory used by PYLINT_HOME. When a victim subsequently runs Pylint, it loads the crafted cache with pickle.load, which can execute arbitrary code as that user.
What can be done before upgrading?
Ensure PYLINT_HOME uses a per-user cache directory that other users cannot write to. Avoid shared or group-writable cache locations and prevent untrusted users from modifying existing Pylint statistics files.
How can I determine whether a deployment is affected?
Check the installed Pylint version and the effective PYLINT_HOME location. Versions before 4.0.9 are affected if that cache location is writable by another user or otherwise untrusted.