Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

Impact Since 2006 / pylint 0.15.2, pylint caches its stats as pickles in PYLINTHOME and reload them on the next run with pickle.load. Someone without access to the configuration or linted code, but with access to the cache directory predictable PYLINTHOME on a multi-user host can write a crafted...

EUVD-2026-108257

Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINTHOME...

UBUNTU-CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

SUSE CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

Linux Distros Unpatched Vulnerability : CVE-2026-114608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those file...

CVE-2026-114608

A flaw was found in Pylint. The application stores module statistics in predictable cache files and deserializes them without adequate validation. A local attacker with write access to a shared or untrusted cache directory can replace these files with malicious data. When Pylint is subsequently...

aedev-project-manager (>=0.3.31, <=0.3.39), baw (>=1.70.2, <=1.89.0) +10 more potentially affected by CVE-2026-114608 via pylint (>=4.0.0, <=4.0.8)

pylint PYPI version =4.0.0, =0.3.31, =1.70.2, =3.12.6, =0.5.0, =0.0.5, =1.17.1rc1, =0.1.3, =6.0.0, =1.0.9, =1.1.0 Source cves: CVE-2026-114608 Source advisory: SNYK:PYTHON-PYLINT-21433563...

Deserialization of Untrusted Data

Overview pylint is a Python static code analysis tool which looks for programming errors, helps enforcing a coding standard, sniffs for code smells and offers simple refactoring suggestions. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via loadresults in...

DEBIAN-CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

AZL-110543 CVE-2026-114608 affecting package pylint 4.0.2-2

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

CVE-2026-114608 Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

CVE-2026-114608 Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

aedev-project-manager (>=0.3.31, <=0.3.39), baw (>=1.70.2, <=1.89.0) +10 more potentially affected by CVE-2026-114608 via pylint (>=4.0.0, <=4.0.8)

pylint PYPI version =4.0.0, =0.3.31, =1.70.2, =3.12.6, =0.5.0, =0.0.5, =1.17.1rc1, =0.1.3, =6.0.0, =1.0.9, =1.1.0 Source cves: CVE-2026-114608 Source advisory: MEND:CVE-2026-114608...

CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

CVE-2026-114608

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINTHOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can...

CVE-2026-114608

The static code analyser Pylint is vulnerable to arbitrary code execution in versions 0.15.2 through 4.0.9 . The root cause is the insecure use of pickle.load to process module statistics stored in predictable files under PYLINT_HOME . An attacker with write access to a shared, group-writable, or...

PT-2026-121426

Name of the Vulnerable Software and Affected Versions Pylint versions 0.15.2 through 4.0.8 Description Pylint stores module statistics in predictable files under PYLINT HOME and loads them using the pickle.load function during subsequent executions. An attacker with write access to a shared,...

Malicious code in pylint-sys (PyPI)

Source: ossf-package-analysis b069b475056c2219d8f5f62b9e0479ba4dfb9a18639f9afd674c9ef90359882d The OpenSSF Package Analysis project identified 'pylint-sys' @ 8.15.6 pypi as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...