CVE-2026-112914
1 advisory.
PyPI/filelock CVE-2026-112914: medium 5.3
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
Action: Upgrade filelock to 4.2.1 or later.
pip install filelock==4.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.1.0 | 4.2.1 | - |
Fixed versions
| 4.2.1 |
Sources
- osv: GHSA-crv4-6mhj-j5jh
- https://github.com/tox-dev/filelock/security/advisories/GHSA-crv4-6mhj-j5jh
- https://nvd.nist.gov/vuln/detail/CVE-2026-112914
- https://github.com/tox-dev/filelock/pull/843
- https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b
- https://github.com/tox-dev/filelock
- https://github.com/tox-dev/filelock/releases/tag/4.2.1
CVE-2026-112914 · published · modified · JSON