Pylint versions prior to 3.0.3-3.oe2403sp3 contain a vulnerability where an attacker with write access to a shared or untrusted cache directory can execute arbitrary code by replacing a serialized stats cache file. This occurs because Pylint loads module statistics using pickle.load from predictable files under PYLINT_HOME. The issue is fixed in version 3.0.3-3.oe2403sp3.