{"schema":"threatline.record/2","record":{"id":"CVE-2026-114608","aliases":["GHSA-22qq-2fwx-7p67"],"summary":"Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME","details":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.","categories":["Unclassified"],"product":"pylint","vendor":"pylint-dev","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114608","source_modified_at":"2026-10-22T16:50:02.569Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"pylint","vendor":"pylint-dev","versions":[{"version":"< 4.0.9","status":"affected"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67","source_modified_at":"2026-10-22T16:49:32Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pylint"},"range":"< 4.0.9"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67","source_modified_at":"2026-10-22T16:49:32Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pylint"},"version":"4.0.9"}],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00115,"percentile":0.01463,"score_date":"2026-10-23"},"published_at":"2026-10-22T16:50:02.569Z","modified_at":"2026-10-22T16:50:02.569Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-114608","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T16:50:02.569Z"},{"source":"GitHub Advisory Database","url":"https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T16:49:32Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114608","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77682ca","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/pylint-dev/pylint/releases/tag/v4.0.9","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-22T16:50:02.569Z","content_hash":"edbe5303a339a51c2d1d1c4833c4ac5e98ca354a21494ae00eabaefdf4fc9454"}}