CVE-2026-114608: Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
Since 2006 / pylint 0.15.2, pylint caches its stats as pickles in PYLINT_HOME and reload them on the next run with pickle.load. Someone without access to the configuration or linted code, but with access to the cache directory (predictable PYLINT_HOME on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache.
References
- github.com/advisories/GHSA-22qq-2fwx-7p67
- github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d
- github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77682ca
- github.com/pylint-dev/pylint/releases/tag/v4.0.9
- github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67
- nvd.nist.gov/vuln/detail/CVE-2026-114608
Code Behaviors & Features
Detect and mitigate CVE-2026-114608 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →