CVE-2026-112937
1 advisory.
PyPI/filelock CVE-2026-112937: medium 6.1
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
Action: Upgrade filelock to 4.2.1 or later.
pip install filelock==4.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.1.0 | 4.2.1 | - |
Fixed versions
| 4.2.1 |
Sources
- osv: GHSA-jqc4-5cvw-7w85
- https://github.com/tox-dev/filelock/security/advisories/GHSA-jqc4-5cvw-7w85
- https://nvd.nist.gov/vuln/detail/CVE-2026-112937
- https://github.com/tox-dev/filelock/pull/834
- https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d
- https://github.com/tox-dev/filelock
- https://github.com/tox-dev/filelock/releases/tag/4.2.1
CVE-2026-112937 · published · modified · JSON