CVE-2026-114608: CWE-502: Deserialization of Untrusted Data in pylint-dev pylint

Pylint, a Python static code analyzer, versions 0.15.2 through 4.0.8 store module statistics in predictable files under PYLINT_HOME and deserialize them using pickle.load on subsequent runs. If an attacker can write to a shared or group-writable cache directory, they can replace the stats cache with crafted serialized data. This leads to arbitrary code execution with the privileges of the user running Pylint. The default per-user cache directory is generally not writable by other users, limiting exposure. The vulnerability is addressed in Pylint version 4.0.9.

An attacker able to write to a shared or group-writable cache directory can execute arbitrary code with the privileges of the user running Pylint. This could lead to privilege escalation or unauthorized code execution on the affected system. However, the default per-user cache directory is usually not writable by others, reducing the risk in typical configurations.

Upgrade Pylint to version 4.0.9 or later, where this vulnerability is fixed. Until then, ensure that cache directories used by Pylint are not writable by untrusted users or groups to prevent exploitation.