Threat database

Pylint versions from 0.15.2 up to but not including 4.0.9 have a vulnerability where module statistics are stored in predictable cache files and loaded using pickle.load. An attacker with write access to the cache directory can replace these files with malicious serialized data, leading to arbitrary code execution with the privileges of the user running Pylint. The default per-user cache is typically not writable by others. This issue is fixed in version 4.0.9.