CVE-2026-112940
1 advisory.
PyPI/filelock CVE-2026-112940: high 7.1
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
Action: Upgrade filelock to 4.2.1 or later.
pip install filelock==4.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.20.4 | 4.2.1 | - |
Fixed versions
| 4.2.1 |
Sources
- osv: GHSA-v4x8-3wr5-3wq8
- https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8
- https://nvd.nist.gov/vuln/detail/CVE-2026-112940
- https://github.com/tox-dev/filelock/pull/834
- https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d
- https://github.com/tox-dev/filelock
- https://github.com/tox-dev/filelock/releases/tag/4.2.1
CVE-2026-112940 · published · modified · JSON