{"action":"Upgrade filelock to 3.20.1 or later.","affected":[{"fixed":"3.20.1","introduced":"0"}],"component":"filelock","cve_ids":["CVE-2025-68146"],"ecosystem":"PyPI","epss":0.00198,"exploited":false,"fixed_versions":["3.20.1"],"ghsa_id":"GHSA-w853-jp5j-5j7f","id":"tcs_01M5KG1S7A4AMXHFR6S866JM84","modified_at":"2026-09-10T03:50:32.252960082Z","published_at":"2025-12-16T20:52:55Z","references":["https://osv.dev/vulnerability/GHSA-w853-jp5j-5j7f","https://github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f","https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e","https://github.com/tox-dev/filelock","https://github.com/tox-dev/filelock/releases/tag/3.20.1","https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants","https://pubs.opengroup.org/onlinepubs/9699919799/functions/open.html"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-w853-jp5j-5j7f","url":"https://osv.dev/vulnerability/GHSA-w853-jp5j-5j7f"}],"summary":"filelock has a TOCTOU race condition which allows symlink attacks during lock file creation"}