{"id":"CVE-2026-114608","aliases":["AZL-110543","DEBIAN-CVE-2026-114608","EUVD-2026-108257","GHSA-22qq-2fwx-7p67","OESA-2026-4699","OESA-2026-4700","OESA-2026-4701","OESA-2026-4742","UBUNTU-CVE-2026-114608","openSUSE-SU-2026:12392-1"],"status":"published","title":"Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME","description":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.","severity":{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00115,"percentile":0.01565,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2026-10-22T16:50:02Z","modified":"2026-11-11T12:45:04Z","fixes":[{"ecosystem":"PyPI","package":"pylint","fixed_in":["4.0.9"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"pylint","fixed_in":["4.0.9-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"pylint","fixed_in":["2.12.2-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"pylint","fixed_in":["3.0.3-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"pylint","fixed_in":["3.0.3-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"pylint","fixed_in":["3.0.3-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-pylint","fixed_in":["4.1.3-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.2-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.2-2","2.17.4-1","3.0.3-1","3.0.3-2","3.1.0-1","3.1.0-2","3.2.2-1","3.2.2-2","3.2.6-1","3.2.7-1","3.3.1-1","3.3.1-2","3.3.3-1","3.3.3-2","3.3.4-1","3.3.4-2","4.0.4-1","4.0.5-1","4.0.6-1","4.0.8-1","4.0.8-2","4.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.4-1","3.3.4-2","4.0.4-1","4.0.5-1","4.0.6-1","4.0.8-1","4.0.8-2","4.0.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-1"}]}],"versions":["3.3.4-1","3.3.4-2","4.0.4-1","4.0.5-1","4.0.6-1","4.0.8-1","4.0.8-2"]},{"source":"osv","ecosystem":"PyPI","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9"}]}],"versions":["0.10.0","0.11.0","0.12.1","0.13.0","0.14.0","0.15.2","0.16.0","0.18.0","0.18.1","0.19.0","0.20.0","0.21.0","0.21.1","0.21.2","0.21.3","0.22.0","0.23.0","0.24.0","0.25.0","0.25.1","0.25.2","0.26.0","0.27.0","0.28.0","0.4.1","0.6.0","0.6.1","0.7.0","0.8.1","1.0.0","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.9.0","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","2.0.0","2.0.0.dev0","2.0.0.dev1","2.0.0.dev2","2.0.1","2.1.0","2.1.1","2.10.0","2.10.1","2.10.2","2.11.0","2.11.1","2.12.0","2.12.1","2.12.2","2.13.0","2.13.1","2.13.2","2.13.3","2.13.4","2.13.5","2.13.6","2.13.7","2.13.8","2.13.9","2.14.0","2.14.0b1","2.14.1","2.14.2","2.14.3","2.14.4","2.14.5","2.15.0","2.15.10","2.15.2","2.15.3","2.15.4","2.15.5","2.15.6","2.15.7","2.15.8","2.15.9","2.16.0","2.16.0.dev0","2.16.0b0","2.16.0b1","2.16.1","2.16.2","2.16.3","2.16.4","2.17.0","2.17.1","2.17.2","2.17.3","2.17.4","2.17.5","2.17.6","2.17.7","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.0.dev0","2.3.0.dev1","2.3.0.dev2","2.3.1","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.7.0.dev1","2.7.1","2.7.1.dev1","2.7.2","2.7.3","2.7.4","2.8.0","2.8.1","2.8.1.dev1","2.8.2","2.8.3","2.9.0","2.9.0.dev1","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","3.0.0","3.0.0a0","3.0.0a1","3.0.0a3","3.0.0a4","3.0.0a5","3.0.0a6","3.0.0a7","3.0.0b0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.5a0","3.3.6","3.3.7","3.3.8","3.3.9","4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.2-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.1-3ubuntu1","1.4.4-1ubuntu1","1.5.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-0ubuntu4","1.8.1-1","1.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-3","2.4.4-1","2.4.4-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.2-3ubuntu1","2.11.1-1","2.12.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17.4-1","3.0.3-1","3.0.3-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5-1","4.0.6-1","4.0.8-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.4-2","4.0.4-1","4.0.5-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-pylint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-1.1"}]}]}],"products":[{"vendor":"pylint-dev","product":"pylint"}],"references":[{"url":"https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77682ca","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/pylint-dev/pylint/releases/tag/v4.0.9","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114608","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-22qq-2fwx-7p67"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114608.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-114608","tags":["advisory"]},{"url":"https://github.com/pylint-dev/pylint","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4699","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4700","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4701","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4742","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-114608","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114608","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-114608","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-114608","title":"Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME","description":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.","status":"published","published":"2026-10-22T16:50:02.569Z","modified":"2026-10-29T11:49:18.315Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T13:39:50.160666Z"}],"euvd":[{"id":"EUVD-2026-108257","description":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.","status":"published","published":"2026-10-22T16:50:02Z","modified":"2026-10-29T11:49:18Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:17.279653Z"}],"ghsa":[{"id":"GHSA-22qq-2fwx-7p67","title":"Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME","description":"### Impact\n\nSince 2006 / pylint 0.15.2, pylint caches its stats as pickles in `PYLINT_HOME` and reload them on the next run with `pickle.load`. Someone without access to the configuration or linted code, but with access to the cache directory (predictable `PYLINT_HOME` on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache.\n\n### Patches\n\nFrom pylint 4.0.9, the result cache is now stored as JSON instead of pickle, preventing code-execution. \n\n### Workarounds\n\nUntil upgrading do not point `PYLINT_HOME` to an untrusted, shared, or group-writable directory. The default value, `~/.cache/pylint`, is writable only by the user running pylint.\n\n### Credits\n\n- Reported privately via Tidelift coordinated disclosure (Dan Lenz).","status":"published","published":"2026-10-27T14:46:51Z","modified":"2026-10-27T14:46:51Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:41:36.858527Z"}],"nvd":[{"id":"CVE-2026-114608","description":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.","status":"published","published":"2026-10-22T17:16:58.75Z","modified":"2026-10-29T12:17:10.16Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:13:02.724605Z"}],"osv":[{"id":"CVE-2026-114608","title":"Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME","description":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.","status":"published","published":"2026-10-22T16:50:02.569Z","modified":"2026-11-03T17:26:57.834206678Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-03T18:00:14.691189Z"},{"id":"DEBIAN-CVE-2026-114608","description":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.","status":"published","published":"2026-10-22T17:16:58.75Z","modified":"2026-11-09T14:00:08.946583934Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-09T14:31:39.434822Z"},{"id":"GHSA-22qq-2fwx-7p67","title":"Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME","description":"### Impact\n\nSince 2006 / pylint 0.15.2, pylint caches its stats as pickles in `PYLINT_HOME` and reload them on the next run with `pickle.load`. Someone without access to the configuration or linted code, but with access to the cache directory (predictable `PYLINT_HOME` on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache.\n\n### Patches\n\nFrom pylint 4.0.9, the result cache is now stored as JSON instead of pickle, preventing code-execution. \n\n### Workarounds\n\nUntil upgrading do not point `PYLINT_HOME` to an untrusted, shared, or group-writable directory. The default value, `~/.cache/pylint`, is writable only by the user running pylint.\n\n### Credits\n\n- Reported privately via Tidelift coordinated disclosure (Dan Lenz).","status":"published","published":"2026-10-27T14:46:51Z","modified":"2026-10-27T15:00:04.526940865Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"OESA-2026-4699","title":"pylint security update","description":"Pylint is a Python source code analyzer which looks for programming errors, helps enforcing a coding standard and sniffs for some code smells (as defined in Martin Fowler\u0026amp;apos;s Refactoring book). Pylint can be seen as another PyChecker since nearly all tests you can do with PyChecker can also be done with Pylint. However, Pylint offers some more features, like checking length of lines of code, checking if variable names are well-formed according to your coding standard, or checking if declared interfaces are truly implemented, and much more. Additionally, it is possible to write plugins to add your own checks.\r\n\r\nSecurity Fix(es):\n\nPylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.(CVE-2026-114608)","status":"published","published":"2026-11-04T13:54:38Z","modified":"2026-11-04T14:00:04.071727085Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-04T14:10:46.921518Z"},{"id":"OESA-2026-4700","title":"pylint security update","description":"Pylint is a Python source code analyzer which looks for programming errors, helps enforcing a coding standard and sniffs for some code smells (as defined in Martin Fowler\u0026amp;apos;s Refactoring book). Pylint can be seen as another PyChecker since nearly all tests you can do with PyChecker can also be done with Pylint. However, Pylint offers some more features, like checking length of lines of code, checking if variable names are well-formed according to your coding standard, or checking if declared interfaces are truly implemented, and much more. Additionally, it is possible to write plugins to add your own checks.\r\n\r\nSecurity Fix(es):\n\nPylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.(CVE-2026-114608)","status":"published","published":"2026-11-04T13:54:38Z","modified":"2026-11-04T14:00:03.770587552Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-04T14:10:46.921518Z"},{"id":"OESA-2026-4701","title":"pylint security update","description":"Pylint is a Python source code analyzer which looks for programming errors, helps enforcing a coding standard and sniffs for some code smells (as defined in Martin Fowler\u0026amp;apos;s Refactoring book). Pylint can be seen as another PyChecker since nearly all tests you can do with PyChecker can also be done with Pylint. However, Pylint offers some more features, like checking length of lines of code, checking if variable names are well-formed according to your coding standard, or checking if declared interfaces are truly implemented, and much more. Additionally, it is possible to write plugins to add your own checks.\r\n\r\nSecurity Fix(es):\n\nPylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.(CVE-2026-114608)","status":"published","published":"2026-11-04T13:54:39Z","modified":"2026-11-04T14:00:03.815343307Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-04T14:10:46.921518Z"},{"id":"OESA-2026-4742","title":"pylint security update","description":"Pylint is a Python source code analyzer which looks for programming errors, helps enforcing a coding standard and sniffs for some code smells (as defined in Martin Fowler\u0026amp;apos;s Refactoring book). Pylint can be seen as another PyChecker since nearly all tests you can do with PyChecker can also be done with Pylint. However, Pylint offers some more features, like checking length of lines of code, checking if variable names are well-formed according to your coding standard, or checking if declared interfaces are truly implemented, and much more. Additionally, it is possible to write plugins to add your own checks.\r\n\r\nSecurity Fix(es):\n\nPylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.(CVE-2026-114608)","status":"published","published":"2026-11-11T12:25:43Z","modified":"2026-11-11T12:45:04.173663811Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"UBUNTU-CVE-2026-114608","description":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.","status":"published","published":"2026-10-22T17:16:00Z","modified":"2026-10-28T17:50:37Z","cvss":[{"version":"4.0","score":5.4,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"AZL-110543","title":"CVE-2026-114608 affecting package pylint 4.0.2-2","description":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.","status":"published","published":"2026-10-22T17:16:58Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"openSUSE-SU-2026:12392-1","title":"python313-pylint-4.1.3-1.1 on GA media","description":"These are all security issues fixed in the python313-pylint-4.1.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-03T17:23:12.792779288Z","updated_at":"2026-11-03T18:00:34.078068Z"}]}}