Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
影響: pip:pylint < 4.0.9 → 4.0.9
Since 2006 / pylint 0.15.2, pylint caches its stats as pickles in PYLINT_HOME and reload them on the next run with pickle.load. Someone without access to the configuration or linted code, but with access to the cache directory (predictable PYLINT_HOME on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache. Patches From pylint 4.0.9, the result cache is now stored as JSON instead of pickle, preventing code-execution. Workarounds Until upg…
| CVE | CVE-2026-114608 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 28. 오전 06:03 |
| 데이터 | Markdown JSON |
2026. 10. 27. 오후 11:46, GitHub Advisory Database에서 "Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-114608.