[ CVE-2026-112934 · Published 20 Oct 2026 ]
Vulnerability in tox-dev filelock
CVSS 6.1
EPSS <1%Fix available
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.
[ Fixes ]Fixes and patches
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD