CVE-2026-114608 Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114608?
CVE-2026-114608 is a medium-severity vulnerability in pylint-dev pylint, published on 22 Oct 2026.
Official description
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.
Weakness: CWE-502
Which versions are affected by CVE-2026-114608?
2 open source packages ship an affected version, including pylint.
| Package | Affected | Fixed in |
|---|---|---|
pylint PyPI | All versions | 4.0.9 |
pylint PyPI | All versions | 4.0.9 |
How do I fix CVE-2026-114608?
Upgrade pylint to 4.0.9 or later.
Is CVE-2026-114608 being exploited?
There is no known exploitation of CVE-2026-114608 in the wild and no public exploit code.
Sources
Also known as AZL-110543, DEBIAN-CVE-2026-114608, GHSA-22qq-2fwx-7p67, UBUNTU-CVE-2026-114608.