GHSA-22qq-2fwx-7p67

### Impact Since 2006 / pylint 0.15.2, pylint caches its stats as pickles in `PYLINT_HOME` and reload them on the next run with `pickle.load`. Someone without access to the configuration or linted code, but with access to the cache directory (predictable `PYLINT_HOME` on a multi-user host) can write a crafted pickle that will runs arbitrary code when pylint access its stat cache. ### Patches From pylint 4.0.9, the result cache is now stored as JSON instead of pickle, preventing code-execution. ### Workarounds Until upgrading do not point `PYLINT_HOME` to an untrusted, shared, or group-writable directory. The default value, `~/.cache/pylint`, is writable only by the user running pylint. ### Credits - Reported privately via Tidelift coordinated disclosure (Dan Lenz).