Arbitrary Code Execution Vulnerability in Pylint by Pylint Dev
CVE-2026-114608

5.4MEDIUM

Key Information:

Vendor

Pylint-dev

Status
Pylint
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114608?

Pylint, a static code analyzer for Python, contains a vulnerability that allows arbitrary code execution due to improper handling of module statistics. Versions 0.15.2 to 4.0.9 store these statistics in predictable files located in PYLINT_HOME and later load them with pickle.load. An attacker with write access to a shared or untrusted cache directory can replace the statistics cache with crafted serialized data. This can lead to arbitrary code execution with the privileges of the user running Pylint, making it a significant security risk. The issue has been addressed in version 4.0.9.

Affected Version(s)

pylint < 4.0.9

References

https://github.com/pylint-dev/pylint/security/advisories/...
x_refsource_CONFIRM
https://github.com/pylint-dev/pylint/commit/58c87cffca9de...
x_refsource_MISC
https://github.com/pylint-dev/pylint/commit/5b241f6631822...
x_refsource_MISC

CVSS V4

Score:
5.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.