{"action":"Upgrade filelock to 4.2.1 or later.","affected":[{"fixed":"4.2.1","introduced":"3.22.0"}],"component":"filelock","cve_ids":["CVE-2026-112907"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["4.2.1"],"ghsa_id":"GHSA-567q-5qvw-pf92","id":"tcs_01M5NGGWNWE17HADEA2WAC177B","modified_at":"2026-10-23T22:45:03.452878321Z","published_at":"2026-10-23T22:27:32Z","references":["https://osv.dev/vulnerability/GHSA-567q-5qvw-pf92","https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"severity":{"label":"low","score":2.5},"sources":[{"source":"osv","source_id":"GHSA-567q-5qvw-pf92","url":"https://osv.dev/vulnerability/GHSA-567q-5qvw-pf92"}],"summary":"filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break"}