{"id":"CVE-2026-114608","aliases":["GHSA-22qq-2fwx-7p67"],"url":"https://o3.security/vulnerability/CVE-2026-114608","summary":"Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME","details":"### Impact\n\nSince 2006 / pylint 0.15.2, pylint caches its stats as pickles in `PYLINT_HOME` and reload them on the next run with `pickle.load`. Someone without access to the configuration or linted code, but with access to the cache directory (predictable `PYLINT_HOME` on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache.\n\n### Patches\n\nFrom pylint 4.0.9, the result cache is now stored as JSON instead of pickle, preventing code-execution. \n\n### Workarounds\n\nUntil upgrading do not point `PYLINT_HOME` to an untrusted, shared, or group-writable directory. The default value, `~/.cache/pylint`, is writable only by the user running pylint.\n\n### Credits\n\n- Reported privately via Tidelift coordinated disclosure (Dan Lenz).","published":"2026-10-22T16:50:02.569Z","modified":"2026-10-28T02:30:47.471626076Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"pylint","fixedVersion":"4.0.9"}],"fix":{"url":"https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d","label":"pylint-dev/pylint@58c87cf"},"references":[{"type":"WEB","url":"https://github.com/pylint-dev/pylint/releases/tag/v4.0.9"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114608.json"},{"type":"ADVISORY","url":"https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114608"},{"type":"FIX","url":"https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d"},{"type":"FIX","url":"https://github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77682ca"},{"type":"PACKAGE","url":"https://github.com/pylint-dev/pylint"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:47.471626076Z"}}