Pylint versions prior to 4.0.9 use pickle serialization for caching stats in the PYLINT_HOME directory. This allows an attacker with write access to the cache directory to craft malicious pickle files that execute arbitrary code when pylint loads the cache. The vulnerability is fixed in pylint 4.0.9, which stores the cache as JSON instead of pickle. Until upgrading, users should ensure PYLINT_HOME is not set to a shared or group-writable directory.