{"id":"AZL-110543","summary":"CVE-2026-114608 affecting package pylint 4.0.2-2","details":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.","modified":"2026-10-23T14:16:26.320007692Z","published":"2026-10-22T17:16:58Z","upstream":["CVE-2026-114608"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114608"}],"affected":[{"package":{"name":"pylint","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/pylint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.2-2"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110543.json"}}],"schema_version":"1.9.0"}