// impact
Since 2006 / pylint 0.15.2, pylint caches its stats as pickles in PYLINT_HOME and reload them on the next run with pickle.load. Someone without access to the configuration or linted code, but with access to the cache directory (predictable PYLINT_HOME on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache.
// patchesFrom pylint 4.0.9, the result cache is now stored as JSON instead of pickle, preventing code-execution.
// workaroundsUntil upgrading do not point PYLINT_HOME to an untrusted, shared, or group-writable directory. The default value, ~/.cache/pylint, is writable only by the user running pylint.
// credits- Reported privately via Tidelift coordinated disclosure (Dan Lenz).
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- Low
- User interaction
- Passive
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None