{"action":"Upgrade filelock to 4.2.1 or later.","affected":[{"fixed":"4.2.1","introduced":"4.1.0"}],"component":"filelock","cve_ids":["CVE-2026-112937"],"ecosystem":"PyPI","epss":0.00096,"exploited":false,"fixed_versions":["4.2.1"],"ghsa_id":"GHSA-jqc4-5cvw-7w85","id":"tcs_01M5NGGW6R25QTKNMGA0Z4P7FZ","modified_at":"2026-10-23T22:45:03.444470915Z","published_at":"2026-10-23T22:28:41Z","references":["https://osv.dev/vulnerability/GHSA-jqc4-5cvw-7w85","https://github.com/tox-dev/filelock/security/advisories/GHSA-jqc4-5cvw-7w85","https://nvd.nist.gov/vuln/detail/CVE-2026-112937","https://github.com/tox-dev/filelock/pull/834","https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d","https://github.com/tox-dev/filelock","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-jqc4-5cvw-7w85","url":"https://osv.dev/vulnerability/GHSA-jqc4-5cvw-7w85"}],"summary":"filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name"}