OESA-2026-4700: pylint security update
Pylint is a Python source code analyzer which looks for programming errors, helps enforcing a coding standard and sniffs for some code smells (as defined in Martin Fowler's Refactoring book). Pylint can be seen as another PyChecker since nearly all tests you can do with PyChecker can also be done with Pylint. However, Pylint offers some more features, like checking length of lines of code, checking if variable names are well-formed according to your coding standard, or checking if declared interfaces are truly implemented, and much more. Additionally, it is possible to write plugins to add your own checks. Security Fix(es):
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.(CVE-2026-114608)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/pylintto a version that resolves this vulnerability.Fixed in 3.0.3-3.oe2403sp1 - Upgrade
Upgrade
Pylintto a version that resolves this vulnerability.Fixed in 4.0.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running Pylint versions from 0.15.2 through 4.0.9 are exposed when Pylint's statistics cache is stored in a shared, group-writable, or otherwise untrusted directory. The default per-user cache is not normally writable by another user.
What does an attacker need to exploit it?
An attacker must be able to write to the directory used for Pylint statistics caches and replace a cache file with crafted serialized data. A user must then run Pylint, which loads the malicious cache with pickle.load.
What is the impact of successful exploitation?
Successful exploitation can execute arbitrary code with the privileges of the user who next runs Pylint.
What can be done if updating is not immediately possible?
Ensure that PYLINT_HOME and any Pylint cache directory are per-user and not writable by other users or untrusted processes. Avoid shared or group-writable cache locations.