{"action":"Upgrade filelock to 3.20.1 or later.","affected":[{"fixed":"3.20.1","introduced":"0"}],"component":"filelock","cve_ids":["CVE-2025-68146"],"ecosystem":"PyPI","epss":0.00198,"exploited":false,"fixed_versions":["3.20.1"],"ghsa_id":"GHSA-w853-jp5j-5j7f","id":"tcs_01M5KGS7EWJ7K6Y4W90E2DQPRS","modified_at":"2026-07-07T17:47:15.042627092Z","published_at":"2026-07-07T16:03:13.114668Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1375","https://github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f","https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e","https://github.com/tox-dev/filelock","https://github.com/tox-dev/filelock/releases/tag/3.20.1","https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants","https://pubs.opengroup.org/onlinepubs/9699919799/functions/open.html","https://pypi.org/project/filelock","https://github.com/advisories/GHSA-w853-jp5j-5j7f","https://nvd.nist.gov/vuln/detail/CVE-2025-68146"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-1375","url":"https://osv.dev/vulnerability/PYSEC-2026-1375"}],"summary":"filelock has a TOCTOU race condition which allows symlink attacks during lock file creation"}