---
id: "CVE-2026-114608"
kind: "vulnerability"
aliases: ["CVE-2026-114608"]
title: "Pylint: stats cache loaded with pickle lets a writer run code"
severity: "medium"
cvss: 5.4
epss: 0.00115
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "package", "pylint", "python", "shared-runners"]
not_affected_if: ["default-config", "single-user-machine"]
published_at: "2026-10-22T17:16:58+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T04:14:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114608", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114608", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Pylint: stats cache loaded with pickle lets a writer run code

Pylint from 0.15.2 through 4.0.9 stores module statistics in predictable files under PYLINT_HOME and later loads them with pickle.load. Someone who can write a crafted file into a shared or untrusted cache directory can run code as the user who next runs Pylint.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pylint --version` and check whether it reports a version between `0.15.2` and `4.0.9`
- Check where the cache lives with `echo $PYLINT_HOME` and look for a shared or group-writable directory there, for example with `ls -ld` on the path

## Fix

- Upgrade pylint to `4.0.9` or later
- Keep PYLINT_HOME in a per-user directory that other users cannot write to

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114608
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114608

## From the sources

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_