Arbitrary code execution in Pylint through its stats cache
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
Pylint from 0.15.2 before 4.0.9 stores module statistics in predictable files under PYLINT_HOME and loads them with pickle, a deserialization of untrusted data flaw (CWE-502). A local attacker who can write to a shared, group-writable or otherwise untrusted cache directory can replace a stats cache with crafted serialized data. Code then runs with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by other users.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pylint-dev | pylint | before 4.0.9 | 4.0.9 | Patch available | CNA |
| — | pylint (PyPI) | before 4.0.9 | 4.0.9 | Patch available | GHSA-22qq-2fwx-7p67 |
- pylint Vendorpylint-dev Affected before 4.0.9 Fixed in 4.0.9 Patch available CNA
- pylint (PyPI) Vendor— Affected before 4.0.9 Fixed in 4.0.9 Patch available GHSA-22qq-2fwx-7p67
Remediation
Upgrade the PyPI package pylint to version 4.0.9, which fixes this issue. Red Hat gives no fix plan for Red Hat OpenShift AI (RHOAI) and Service Telemetry Framework 1.5.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA pylint (pylint-dev) Fixed in 4.0.9
- Fix · GHSA-22qq-2fwx-7p67 pylint (PyPI) Fixed in 4.0.9 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Service Telemetry Framework 1.5 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-22 Threatist record created from CVE-2026-114608
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-23 CVSS score added · Red Hat
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-27 Alias added: GHSA-22qq-2fwx-7p67
- 2026-10-29 CISA SSVC decision points changed
References
Other 5
- https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67
- https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d
- https://github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77682ca
- https://github.com/pylint-dev/pylint/releases/tag/v4.0.9
- https://github.com/pylint-dev/pylint
Sources
- CVE-2026-114608 · CVE Program
- CVE-2026-114608 · NVD
- FIRST EPSS
- GHSA-22qq-2fwx-7p67 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-114608 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences