{"id":"ghsa-ghsa-22qq-2fwx-7p67","seq":1708819,"kind":"advisory","title":"Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME","url":"https://github.com/advisories/GHSA-22qq-2fwx-7p67","permalink":"https://vulnpulse.app/items/ghsa-ghsa-22qq-2fwx-7p67","summary":"影響: pip:pylint < 4.0.9 → 4.0.9\nSince 2006 / pylint 0.15.2, pylint caches its stats as pickles in PYLINT_HOME and reload them on the next run with pickle.load. Someone without access to the configuration or linted code, but with access to the cache directory (predictable PYLINT_HOME on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache. Patches From pylint 4.0.9, the result cache is now stored as JSON instead of pickle, preventing code-execution. Workarounds Until upg…","severity":"medium","techs":["python"],"cves":["CVE-2026-114608"],"tags":["GHSA-22qq-2fwx-7p67","pylint"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T14:46:51.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}