CVE-2025-68146
2 advisories.
PyPI/filelock CVE-2025-68146: medium 6.3, EPSS 0.20%
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
Action: Upgrade filelock to 3.20.1 or later.
pip install filelock==3.20.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.20.1 | - |
Fixed versions
| 3.20.1 |
Sources
- osv: GHSA-w853-jp5j-5j7f
- https://github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f
- https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e
- https://github.com/tox-dev/filelock
- https://github.com/tox-dev/filelock/releases/tag/3.20.1
- https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants
- https://pubs.opengroup.org/onlinepubs/9699919799/functions/open.html
CVE-2025-68146 · published · modified · JSON
PyPI/filelock CVE-2025-68146: medium 6.3, EPSS 0.20%
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
Action: Upgrade filelock to 3.20.1 or later.
pip install filelock==3.20.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.20.1 | - |
Fixed versions
| 3.20.1 |
Sources
- osv: PYSEC-2026-1375
- https://github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f
- https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e
- https://github.com/tox-dev/filelock
- https://github.com/tox-dev/filelock/releases/tag/3.20.1
- https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants
- https://pubs.opengroup.org/onlinepubs/9699919799/functions/open.html
- https://pypi.org/project/filelock
- https://github.com/advisories/GHSA-w853-jp5j-5j7f
- https://nvd.nist.gov/vuln/detail/CVE-2025-68146
CVE-2025-68146 · published · modified · JSON