CVE catalog
CVE-2026-114608
pylint: CVE-2026-114608
- Severity
- Medium · CVSS 6.7
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.11% · Oct 25, 2026
Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | pylint | sid | 4.0.8-2 | vulnerable |
| Debian | pylint | forky | 4.0.8-2 | vulnerable |
| Debian | pylint | trixie | 3.3.4-1 | vulnerable |
| Debian | pylint | bookworm | 2.16.2-2 | vulnerable |
| Ubuntu | pylint | 16.04 | 1.3.1-3ubuntu1 | vulnerable |
| Ubuntu | pylint | 16.04 | 1.4.4-1ubuntu1 | vulnerable |
| Ubuntu | pylint | 16.04 | 1.5.2-1ubuntu1 | vulnerable |
| Ubuntu | pylint | 18.04 | 1.7.2-0ubuntu4 | vulnerable |
| Ubuntu | pylint | 18.04 | 1.8.1-1 | vulnerable |
| Ubuntu | pylint | 18.04 | 1.8.3-1 | vulnerable |
| Ubuntu | pylint | 20.04 | 2.2.2-3 | vulnerable |
| Ubuntu | pylint | 20.04 | 2.4.4-1 | vulnerable |
| Ubuntu | pylint | 20.04 | 2.4.4-2 | vulnerable |
| Ubuntu | pylint | 22.04 | 2.7.2-3ubuntu1 | vulnerable |
| Ubuntu | pylint | 22.04 | 2.11.1-1 | vulnerable |
| Ubuntu | pylint | 22.04 | 2.12.2-1 | vulnerable |
| Ubuntu | pylint | 24.04 | 2.17.4-1 | vulnerable |
| Ubuntu | pylint | 24.04 | 3.0.3-1 | vulnerable |
| Ubuntu | pylint | 24.04 | 3.0.3-2 | vulnerable |
| Ubuntu | pylint | 26.10 | 4.0.5-1 | vulnerable |
| Ubuntu | pylint | 26.10 | 4.0.6-1 | vulnerable |
| Ubuntu | pylint | 26.10 | 4.0.8-1 | vulnerable |
| Ubuntu | pylint | 26.04 | 3.3.4-2 | vulnerable |
| Ubuntu | pylint | 26.04 | 4.0.4-1 | vulnerable |
| Ubuntu | pylint | 26.04 | 4.0.5-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | pylint | source | sid | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | pylint | source | forky | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | pylint | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | pylint | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [pylint]Affected
Details (2)
2.16.2-2· all · bookwormAffected
dsa · pylint · debian · bookworm; dsa · pylint · debian · 12
2.16.2-2· all · bookwormAffected
dsa · pylint · debian · bookworm; dsa · pylint · debian · 12
- [pylint-doc]Affected
Source package: [pylint]
Details (2)
2.16.2-2· all · bookwormAffected
dsa · pylint · debian · bookworm; dsa · pylint · debian · 12
2.16.2-2· all · bookwormAffected
dsa · pylint · debian · bookworm; dsa · pylint · debian · 12
[Debian 13 (Trixie)]
- [pylint]Affected
Details (2)
3.3.4-1· all · trixieAffected
dsa · pylint · debian · 13
3.3.4-1· all · trixieAffected
dsa · pylint · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-114608]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-114608]
- [https://security-tracker.debian.org/tracker/CVE-2026-114608]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114608.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]