CVE-2026-112934GHSA-fj95-fr6c-h845
filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
tox-dev filelock
CVSS
6.1MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 22 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.
Text from CVE List
Affected versions 1
- filelockaffected: >= 4.0.0, < 4.2.1CVE List