{"action":"Upgrade filelock to 4.2.1 or later.","affected":[{"fixed":"4.2.1","introduced":"3.20.4"}],"component":"filelock","cve_ids":["CVE-2026-112940"],"ecosystem":"PyPI","epss":0.0019,"exploited":false,"fixed_versions":["4.2.1"],"ghsa_id":"GHSA-v4x8-3wr5-3wq8","id":"tcs_01M5NDPPTVEF08DVTCQVNH8N68","modified_at":"2026-10-23T22:15:04.432475030Z","published_at":"2026-10-23T21:59:08Z","references":["https://osv.dev/vulnerability/GHSA-v4x8-3wr5-3wq8","https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8","https://nvd.nist.gov/vuln/detail/CVE-2026-112940","https://github.com/tox-dev/filelock/pull/834","https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d","https://github.com/tox-dev/filelock","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-v4x8-3wr5-3wq8","url":"https://osv.dev/vulnerability/GHSA-v4x8-3wr5-3wq8"}],"summary":"filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files"}