CVE-2026-114608
- Source
- https://cve.org/CVERecord?id=CVE-2026-114608
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114608.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-114608
- Aliases
-
- GHSA-22qq-2fwx-7p67
- Published
- 2026-10-22T16:50:02Z
- Modified
- 2026-10-23T02:45:50Z
- Severity
-
- 5.4 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
- Details
-
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-502" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114608.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114608.json
- https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d
- https://github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77682ca
- https://github.com/pylint-dev/pylint/releases/tag/v4.0.9
- https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67
- https://nvd.nist.gov/vuln/detail/CVE-2026-114608
Affected packages
Git / github.com/pylint-dev/pylint
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pylint-dev/pylint
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "4.0.9" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "58c87cffca9de2b3e89aa07b89686cbc90cfea2d" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "5b241f66318220e9ba7b21ca631fbfe8e77682ca" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v4.0.9", "range": [ { "fixed": "303703fe107fa812c42a66edfc88a5702a63f1f1" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
Other
before-astroid
pylint-debian-version-0_15_0-1
pylint-debian-version-0_15_1-1
pylint-debian-version-0_15_2-1
pylint-version-0_15_0
pylint-version-0_15_1
pylint-version-0_15_2
pylint-version-0_17_0
pylint-1.*
pylint-1.3
pylint-1.4
pylint-1.4.1
pylint-1.4.2
pylint-1.4.3
pylint-1.7.0
pylint-1.8.0
pylint-1.8.1
pylint-2.*
pylint-2.0
pylint-2.0.dev
pylint-2.0.dev1
pylint-2.1.0
pylint-2.2.0
pylint-2.2.1
pylint-2.2.2
pylint-2.3.0
pylint-2.4.0
pylint-2.4.1
pylint-2.4.2
pylint-2.5.0
pylint-2.6.0
pylint-2.7.3
pylint-2.7.4
pylint-2.8.0
pylint-2.8.1
pylint-debian-version-0.*
pylint-debian-version-0.18.1-1
pylint-debian-version-0.19.0-1
pylint-debian-version-0.20.0-1
pylint-debian-version-0.21.0-1
pylint-debian-version-0.21.1-1
pylint-debian-version-0.21.2-1
pylint-debian-version-0.21.3-1
pylint-debian-version-0.21.4-1
pylint-debian-version-0.22.0-1
pylint-debian-version-0.24.0-1
pylint-debian-version-0.25.0-1
pylint-debian-version-0.25.1-1
pylint-debian-version-0.25.2-1
pylint-debian-version-0.26.0-1
pylint-debian-version-0.27.0-1
pylint-debian-version-0.28.0-1
pylint-debian-version-1.*
pylint-debian-version-1.0.0-1
pylint-debian-version-1.1.0-1
pylint-version-0.*
pylint-version-0.18.1
pylint-version-0.19.0
pylint-version-0.20.0
pylint-version-0.21.0
pylint-version-0.21.1
pylint-version-0.21.2
pylint-version-0.21.3
pylint-version-0.21.4
pylint-version-0.22.0
pylint-version-0.23.0
pylint-version-0.24.0
pylint-version-0.25.0
pylint-version-0.25.1
pylint-version-0.25.2
pylint-version-0.26.0
pylint-version-0.27.0
pylint-version-0.28.0
pylint-version-1.*
pylint-version-1.0.0
pylint-version-1.1.0
v2.*
v2.10.0
v2.10.1
v2.10.2
v2.11.0
v2.11.1
v2.12.0
v2.12.1
v2.12.2
v2.13.0
v2.14.0
v2.14.0-b1
v2.15.0
v2.16.0
v2.16.0b0
v2.16.0b1
v2.17.0
v2.8.2
v2.9.0
v2.9.1
v2.9.2
v2.9.3
v2.9.4
v2.9.5
v3.*
v3.0.0
v3.0.0a6
v3.0.0a7
v3.0.0b0
v3.1.0
v3.2.0
v3.3.0
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8