GHSA-22qq-2fwx-7p67

Suggest an improvement
Source
https://github.com/advisories/GHSA-22qq-2fwx-7p67
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-22qq-2fwx-7p67/GHSA-22qq-2fwx-7p67.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-22qq-2fwx-7p67
Aliases
Published
2026-10-27T14:46:51Z
Modified
2026-10-27T15:00:04Z
Severity
  • 5.4 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
Details

Impact

Since 2006 / pylint 0.15.2, pylint caches its stats as pickles in PYLINT_HOME and reload them on the next run with pickle.load. Someone without access to the configuration or linted code, but with access to the cache directory (predictable PYLINT_HOME on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache.

Patches

From pylint 4.0.9, the result cache is now stored as JSON instead of pickle, preventing code-execution.

Workarounds

Until upgrading do not point PYLINT_HOME to an untrusted, shared, or group-writable directory. The default value, ~/.cache/pylint, is writable only by the user running pylint.

Credits

  • Reported privately via Tidelift coordinated disclosure (Dan Lenz).
Database specific 
{
    "cwe_ids":  [
        "CWE-502"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-27T14:46:51Z",
    "nvd_published_at":  "2026-10-22T17:16:58Z",
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / pylint

Package

Name
pylint
View open source insights on deps.dev
Purl
pkg:pypi/pylint

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.0.9

Affected versions

0.*
0.4.1
0.6.0
0.6.1
0.7.0
0.8.1
0.10.0
0.11.0
0.12.1
0.13.0
0.14.0
0.15.2
0.16.0
0.18.0
0.18.1
0.19.0
0.20.0
0.21.0
0.21.1
0.21.2
0.21.3
0.22.0
0.23.0
0.24.0
0.25.0
0.25.1
0.25.2
0.26.0
0.27.0
0.28.0
1.*
1.0.0
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.7.6
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
2.*
2.0.0.dev0
2.0.0.dev1
2.0.0.dev2
2.0.0
2.0.1
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0.dev0
2.3.0.dev1
2.3.0.dev2
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.6.2
2.7.0.dev1
2.7.0
2.7.1.dev1
2.7.1
2.7.2
2.7.3
2.7.4
2.8.0
2.8.1.dev1
2.8.1
2.8.2
2.8.3
2.9.0.dev1
2.9.0
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.10.0
2.10.1
2.10.2
2.11.0
2.11.1
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13.6
2.13.7
2.13.8
2.13.9
2.14.0b1
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.15.0
2.15.2
2.15.3
2.15.4
2.15.5
2.15.6
2.15.7
2.15.8
2.15.9
2.15.10
2.16.0.dev0
2.16.0b0
2.16.0b1
2.16.0
2.16.1
2.16.2
2.16.3
2.16.4
2.17.0
2.17.1
2.17.2
2.17.3
2.17.4
2.17.5
2.17.6
2.17.7
3.*
3.0.0a0
3.0.0a1
3.0.0a3
3.0.0a4
3.0.0a5
3.0.0a6
3.0.0a7
3.0.0b0
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.1
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5a0
3.3.5
3.3.6
3.3.7
3.3.8
3.3.9
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-22qq-2fwx-7p67/GHSA-22qq-2fwx-7p67.json"