Log in Start free

Vulnerability · Published Oct 22, 2026 · Assigned by GitHub_M

CVE-2026-114608Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

Medium 5.4

In plain English

A medium-severity unsafe deserialization in pylint from pylint-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.4Medium
Exploit odds (30 days)0.1%top 98.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12pylintno fix listedDEBIAN-CVE-2026-114608
Debian:13pylintno fix listedDEBIAN-CVE-2026-114608
Debian:14pylintno fix listedDEBIAN-CVE-2026-114608
PyPIpylint4.0.9GHSA-22qq-2fwx-7p67
Ubuntu:22.04:LTSpylintno fix listedUBUNTU-CVE-2026-114608
Ubuntu:24.04:LTSpylintno fix listedUBUNTU-CVE-2026-114608
Ubuntu:26.04:LTSpylintno fix listedUBUNTU-CVE-2026-114608
Ubuntu:26.10pylintno fix listedUBUNTU-CVE-2026-114608

Affected products (as reported)

VendorProductVersions
pylint-dev pylint < 4.0.9

Weakness: CWE-502 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References