{"action":"Upgrade filelock to 3.20.3 or later.","affected":[{"fixed":"3.20.3","introduced":"0"}],"component":"filelock","cve_ids":["CVE-2026-22701"],"ecosystem":"PyPI","epss":0.00127,"exploited":false,"fixed_versions":["3.20.3"],"ghsa_id":"GHSA-qmgc-5h2g-mvrw","id":"tcs_01M5KFWC3EJHTZY9BZEH203W2M","modified_at":"2026-09-10T03:50:33.702580779Z","published_at":"2026-01-13T18:44:55Z","references":["https://osv.dev/vulnerability/GHSA-qmgc-5h2g-mvrw","https://github.com/tox-dev/filelock/security/advisories/GHSA-qmgc-5h2g-mvrw","https://nvd.nist.gov/vuln/detail/CVE-2026-22701","https://github.com/tox-dev/filelock/commit/255ed068bc85d1ef406e50a135e1459170dd1bf0","https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5","https://github.com/tox-dev/filelock"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-qmgc-5h2g-mvrw","url":"https://osv.dev/vulnerability/GHSA-qmgc-5h2g-mvrw"}],"summary":"filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock"}