{"affected":[{"product":"filelock","source":"CNA: GitHub_M","vendor":"tox-dev","versions":[{"status":"affected","version":">= 3.10.0, < 4.2.1"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"filelock","product":"filelock","source":"OSV GHSA-8mx5-7m5m-r77g","vendor":"","versions":[{"status":"affected","version":"3.10.0","versionType":"PyPI"},{"status":"affected","version":"3.10.1","versionType":"PyPI"},{"status":"affected","version":"3.10.2","versionType":"PyPI"},{"status":"affected","version":"3.10.3","versionType":"PyPI"},{"status":"affected","version":"3.10.4","versionType":"PyPI"},{"status":"affected","version":"3.10.5","versionType":"PyPI"},{"status":"affected","version":"3.10.6","versionType":"PyPI"},{"status":"affected","version":"3.10.7","versionType":"PyPI"},{"status":"affected","version":"3.11.0","versionType":"PyPI"},{"status":"affected","version":"3.12.0","versionType":"PyPI"},{"status":"affected","version":"3.12.1","versionType":"PyPI"},{"status":"affected","version":"3.12.2","versionType":"PyPI"},{"status":"affected","version":"3.12.3","versionType":"PyPI"},{"status":"affected","version":"3.12.4","versionType":"PyPI"},{"status":"affected","version":"3.13.0","versionType":"PyPI"},{"status":"affected","version":"3.13.1","versionType":"PyPI"},{"status":"affected","version":"3.13.2","versionType":"PyPI"},{"status":"affected","version":"3.13.3","versionType":"PyPI"},{"status":"affected","version":"3.13.4","versionType":"PyPI"},{"status":"affected","version":"3.14.0","versionType":"PyPI"},{"status":"affected","version":"3.15.0","versionType":"PyPI"},{"status":"affected","version":"3.15.1","versionType":"PyPI"},{"status":"affected","version":"3.15.2","versionType":"PyPI"},{"status":"affected","version":"3.15.3","versionType":"PyPI"},{"status":"affected","version":"3.15.4","versionType":"PyPI"},{"status":"affected","version":"3.16.0","versionType":"PyPI"},{"status":"affected","version":"3.16.1","versionType":"PyPI"},{"status":"affected","version":"3.17.0","versionType":"PyPI"},{"status":"affected","version":"3.18.0","versionType":"PyPI"},{"status":"affected","version":"3.19.1","versionType":"PyPI"},{"status":"affected","version":"3.20.0","versionType":"PyPI"},{"status":"affected","version":"3.20.1","versionType":"PyPI"},{"status":"affected","version":"3.20.2","versionType":"PyPI"},{"status":"affected","version":"3.20.3","versionType":"PyPI"},{"status":"affected","version":"3.20.4","versionType":"PyPI"},{"status":"affected","version":"3.21.0","versionType":"PyPI"},{"status":"affected","version":"3.21.1","versionType":"PyPI"},{"status":"affected","version":"3.21.2","versionType":"PyPI"},{"status":"affected","version":"3.22.0","versionType":"PyPI"},{"status":"affected","version":"3.23.0","versionType":"PyPI"},{"status":"affected","version":"3.24.0","versionType":"PyPI"},{"status":"affected","version":"3.24.1","versionType":"PyPI"},{"status":"affected","version":"3.24.2","versionType":"PyPI"},{"status":"affected","version":"3.24.3","versionType":"PyPI"},{"status":"affected","version":"3.25.0","versionType":"PyPI"},{"status":"affected","version":"3.25.1","versionType":"PyPI"},{"status":"affected","version":"3.25.2","versionType":"PyPI"},{"status":"affected","version":"3.28.0","versionType":"PyPI"},{"status":"affected","version":"3.29.0","versionType":"PyPI"},{"status":"affected","version":"3.29.1","versionType":"PyPI"},{"status":"affected","version":"3.29.2","versionType":"PyPI"},{"status":"affected","version":"3.29.3","versionType":"PyPI"},{"status":"affected","version":"3.29.4","versionType":"PyPI"},{"status":"affected","version":"3.29.5","versionType":"PyPI"},{"status":"affected","version":"3.29.6","versionType":"PyPI"},{"status":"affected","version":"3.29.7","versionType":"PyPI"},{"status":"affected","version":"3.30.0","versionType":"PyPI"},{"status":"affected","version":"3.30.1","versionType":"PyPI"},{"status":"affected","version":"3.30.2","versionType":"PyPI"},{"status":"affected","version":"3.30.3","versionType":"PyPI"},{"status":"affected","version":"3.31.0","versionType":"PyPI"},{"status":"affected","version":"3.31.1","versionType":"PyPI"},{"status":"affected","version":"3.31.2","versionType":"PyPI"},{"status":"affected","version":"3.32.0","versionType":"PyPI"},{"status":"affected","version":"3.32.2","versionType":"PyPI"},{"status":"affected","version":"3.32.3","versionType":"PyPI"},{"status":"affected","version":"3.32.4","versionType":"PyPI"},{"status":"affected","version":"3.32.5","versionType":"PyPI"},{"status":"affected","version":"3.32.6","versionType":"PyPI"},{"status":"affected","version":"3.32.7","versionType":"PyPI"},{"status":"affected","version":"4.0.0","versionType":"PyPI"},{"status":"affected","version":"4.0.1","versionType":"PyPI"},{"status":"affected","version":"4.0.10","versionType":"PyPI"},{"status":"affected","version":"4.0.11","versionType":"PyPI"},{"status":"affected","version":"4.0.12","versionType":"PyPI"},{"status":"affected","version":"4.0.2","versionType":"PyPI"},{"status":"affected","version":"4.0.3","versionType":"PyPI"},{"status":"affected","version":"4.0.4","versionType":"PyPI"},{"status":"affected","version":"4.0.5","versionType":"PyPI"},{"status":"affected","version":"4.0.6","versionType":"PyPI"},{"status":"affected","version":"4.0.7","versionType":"PyPI"},{"status":"affected","version":"4.0.8","versionType":"PyPI"},{"status":"affected","version":"4.0.9","versionType":"PyPI"},{"status":"affected","version":"4.1.0","versionType":"PyPI"},{"status":"affected","version":"4.1.1","versionType":"PyPI"},{"status":"affected","version":"4.1.2","versionType":"PyPI"},{"status":"affected","version":"4.2.0","versionType":"PyPI"},{"events":[{"introduced":"3.10.0"},{"fixed":"4.2.1"}],"status":"unknown","version":"3.10.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-112910","cwes":["CWE-732"],"description":"filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the parent directory's inheritable ACL because _open_non_reparse_fd and _nt_open do not create an owner-only security descriptor. Another local account with inherited access can read holder metadata or the lock database, modify those files where the ACL permits writes, or take the byte-range lock after release and delay later acquisitions. UnixFileLock is not affected, and mutual exclusion between cooperating processes continues to hold. This issue is fixed in version 4.2.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}],"modifiedAt":1793915255134,"publishedAt":1793915255134,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-8mx5-7m5m-r77g"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tox-dev/filelock/pull/835"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tox-dev/filelock/commit/72786d41aa25159ad28c1bcf4291738b135b2c6c"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-8mx5-7m5m-r77g"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-8mx5-7m5m-r77g"}],"remediation":[{"kind":"fix","source":"OSV GHSA-8mx5-7m5m-r77g","text":"filelock (PyPI): OSV reports a fixed version 4.2.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-8mx5-7m5m-r77g"}],"revision":"e3652ff8870c957f80c349b82577d4630fed0a7f67a99cf0cda5cdf1c9c75ef7","sources":[{"modifiedAt":1793915255134,"name":"CNA: GitHub_M","retrievedAt":1793916779699,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112910"},{"modifiedAt":1793222105688,"name":"OSV / GitHub Security Advisories","retrievedAt":1793916780336,"url":"https://osv.dev/vulnerability/GHSA-8mx5-7m5m-r77g"}],"ssvc":null,"status":"published","title":"filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL","updatedAt":1793916780336}