{"affected":[{"product":"filelock","source":"CNA: GitHub_M","vendor":"tox-dev","versions":[{"status":"affected","version":">= 3.30.0, < 4.2.1"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"filelock","product":"filelock","source":"OSV GHSA-m462-7rxw-wvpg","vendor":"","versions":[{"status":"affected","version":"3.30.0","versionType":"PyPI"},{"status":"affected","version":"3.30.1","versionType":"PyPI"},{"status":"affected","version":"3.30.2","versionType":"PyPI"},{"status":"affected","version":"3.30.3","versionType":"PyPI"},{"status":"affected","version":"3.31.0","versionType":"PyPI"},{"status":"affected","version":"3.31.1","versionType":"PyPI"},{"status":"affected","version":"3.31.2","versionType":"PyPI"},{"status":"affected","version":"3.32.0","versionType":"PyPI"},{"status":"affected","version":"3.32.2","versionType":"PyPI"},{"status":"affected","version":"3.32.3","versionType":"PyPI"},{"status":"affected","version":"3.32.4","versionType":"PyPI"},{"status":"affected","version":"3.32.5","versionType":"PyPI"},{"status":"affected","version":"3.32.6","versionType":"PyPI"},{"status":"affected","version":"3.32.7","versionType":"PyPI"},{"status":"affected","version":"4.0.0","versionType":"PyPI"},{"status":"affected","version":"4.0.1","versionType":"PyPI"},{"status":"affected","version":"4.0.10","versionType":"PyPI"},{"status":"affected","version":"4.0.11","versionType":"PyPI"},{"status":"affected","version":"4.0.12","versionType":"PyPI"},{"status":"affected","version":"4.0.2","versionType":"PyPI"},{"status":"affected","version":"4.0.3","versionType":"PyPI"},{"status":"affected","version":"4.0.4","versionType":"PyPI"},{"status":"affected","version":"4.0.5","versionType":"PyPI"},{"status":"affected","version":"4.0.6","versionType":"PyPI"},{"status":"affected","version":"4.0.7","versionType":"PyPI"},{"status":"affected","version":"4.0.8","versionType":"PyPI"},{"status":"affected","version":"4.0.9","versionType":"PyPI"},{"status":"affected","version":"4.1.0","versionType":"PyPI"},{"status":"affected","version":"4.1.1","versionType":"PyPI"},{"status":"affected","version":"4.1.2","versionType":"PyPI"},{"status":"affected","version":"4.2.0","versionType":"PyPI"},{"events":[{"introduced":"3.30.0"},{"fixed":"4.2.1"}],"status":"unknown","version":"3.30.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-112938","cwes":["CWE-363"],"description":"filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, On POSIX platforms, StrictSoftFileLock and AsyncStrictSoftFileLock validate the coordination directory in _ensure_protocol_directory but later reach the claims directory through _open_directory by pathname, allowing a local account that can rename the coordination name to swap in a symbolic link between check and use during acquisition. That race can create and leave claim files in another writable directory or strand claims in a different strict lock so the second lock times out. Separately, the claims property and force_break follow a resting symbolic link without a race when the lock user inspects or recovers the lock. Claims inspection discloses a file name to the other account only if the resulting exception text or claim_name reaches that account through a shared log, CI output, or error report. A blind force_break recovery that removes live claims from another strict lock can allow two processes into that lock's critical section; this path reaches other strict locks, not arbitrary files. This issue is fixed in version 4.2.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.8,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","version":"3.1"}],"modifiedAt":1793915464350,"publishedAt":1793915464350,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-m462-7rxw-wvpg"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tox-dev/filelock/pull/839"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tox-dev/filelock/commit/aaa18595d29795fab599a69d6b184d9a505dab4b"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-m462-7rxw-wvpg"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-m462-7rxw-wvpg"}],"remediation":[{"kind":"fix","source":"OSV GHSA-m462-7rxw-wvpg","text":"filelock (PyPI): OSV reports a fixed version 4.2.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-m462-7rxw-wvpg"}],"revision":"cb530e37b4a8897fe88aed467acfe6b705028312f22d668ae8d24d6057dab820","sources":[{"modifiedAt":1793915464350,"name":"CNA: GitHub_M","retrievedAt":1793916781917,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112938"},{"modifiedAt":1793222104165,"name":"OSV / GitHub Security Advisories","retrievedAt":1793916782517,"url":"https://osv.dev/vulnerability/GHSA-m462-7rxw-wvpg"}],"ssvc":null,"status":"published","title":"filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses","updatedAt":1793916782517}