CVE-2026-114608

Name of the Vulnerable Software and Affected Versions Pylint versions 0.15.2 through 4.0.8

Description Pylint stores module statistics in predictable files under PYLINT HOME and loads them using the pickle.load() function during subsequent executions. An attacker with write access to a shared, group-writable, or untrusted cache directory can replace a statistics cache file with malicious serialized data. This leads to arbitrary code execution with the privileges of the user running Pylint. The default per-user cache is typically not writable by other users.

Recommendations Update to version 4.0.9.