GHSA-22qq-2fwx-7p67 Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME

• PyPI pylint: < 4.0.9 → fixed in 4.0.9

Impact Since 2006 / pylint 0.15.2, pylint caches its stats as pickles in `PYLINT_HOME` and reload them on the next run with `pickle.load`. Someone without access to the configuration or linted code, but with access to the cache directory (predictable `PYLINT_HOME` on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache. Patches From pylint 4.0.9, the result cache is now stored as JSON instead of pickle, preventing code-execution. Workarounds Until upgrading do not point `PYLINT_HOME` to an untrusted, shared, or group-writable directory. The default value, `~/.cache/pylint`, is writable only by the user running pylint. Credits • Reported privately via Tidelift coordinated disclosure (Dan Lenz).