cyfenced.com →

[ CVE-2026-112939 · Published 20 Oct 2026 ]

Vulnerability in tox-dev filelock

CVSS 4.7 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.

[ Fixes ]Fixes and patches

[ References ]References