{"action":"Upgrade filelock to 4.2.1 or later.","affected":[{"fixed":"4.2.1","introduced":"4.1.0"}],"component":"filelock","cve_ids":["CVE-2026-112914"],"ecosystem":"PyPI","epss":0.00161,"exploited":false,"fixed_versions":["4.2.1"],"ghsa_id":"GHSA-crv4-6mhj-j5jh","id":"tcs_01M5NDPYNPV779TP1BHK3RG4ZB","modified_at":"2026-10-23T22:15:05.387500982Z","published_at":"2026-10-23T22:00:11Z","references":["https://osv.dev/vulnerability/GHSA-crv4-6mhj-j5jh","https://github.com/tox-dev/filelock/security/advisories/GHSA-crv4-6mhj-j5jh","https://nvd.nist.gov/vuln/detail/CVE-2026-112914","https://github.com/tox-dev/filelock/pull/843","https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b","https://github.com/tox-dev/filelock","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-crv4-6mhj-j5jh","url":"https://osv.dev/vulnerability/GHSA-crv4-6mhj-j5jh"}],"summary":"filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory"}