CVE-2026-114608
MEDIUM
5,4
Source: [email protected]
Attack Vector: local
Attack Complexity: high
Privileges Required: low
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.
502
Deserialization of Untrusted Data
DraftCommon Consequences
Security Scopes Affected:
Integrity
Availability
Other
Potential Impacts:
Modify Application Data
Unexpected State
Dos: Resource Consumption (Cpu)
Varies By Context
Applicable Platforms
Languages:
Java, Ruby, PHP, Python, JavaScript
Technologies:
Not Technology-Specific, ICS/OT, AI/ML
https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90c…
https://github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77…
https://github.com/pylint-dev/pylint/releases/tag/v4.0.9
https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67