Live › vulnerability › CVE-2026-114608
Go to dashboardPylint from 0.15.2 through 4.0.9 stores module statistics in predictable files under PYLINT_HOME and later loads them with pickle.load. Someone who can write a crafted file into a shared or untrusted cache directory can run code as the user who next runs Pylint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only setups where the Pylint cache directory is shared, group-writable, or otherwise writable by someone other than the user running Pylint, such as shared CI runners or build hosts that reuse a common PYLINT_HOME. The default per-user cache is not normally writable by another user, so single-developer machines with default settings are unlikely to be exposed.
No product ranges from the sources yet.
pylint --version and check whether it reports a version between 0.15.2 and 4.0.9echo $PYLINT_HOME and look for a shared or group-writable directory there, for example with ls -ld on the path4.0.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-114608")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.