Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

影響: pip:pylint < 4.0.9 → 4.0.9

Since 2006 / pylint 0.15.2, pylint caches its stats as pickles in PYLINT_HOME and reload them on the next run with pickle.load. Someone without access to the configuration or linted code, but with access to the cache directory (predictable PYLINT_HOME on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache. Patches From pylint 4.0.9, the result cache is now stored as JSON instead of pickle, preventing code-execution. Workarounds Until upg…

GitHub Advisory Databaseで読む

2026/10/27 23:46、GitHub Advisory Databaseが「Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-114608。