Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-112906 · GHSA-2g95-wg33-c5x2

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

Risk score
40/100
CVSS
4.7 v3.1
Exploit chance (30 days)
0.2%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the observation, and an hon…
Affected
filelock (pip) >= 4.1.0, <= 4.2.0
Fix
Upgrade filelock to 4.2.1 or later.
Exploitation
Public proof of concept

Story map

Story map: Tox-dev FilelockTHE FLAWSTHE FIXCVE-2026-112906SoftFileLock evicts a freshlock file whose watched ageanother local user's pre-dated…CVSS 4.7 · EPSS 0%CVE-2026-112934Filelock is aplatform-independent file lockfor PythonCVSS 6.1 · EPSS 0%CVE-2026-112936Filelock is aplatform-independent file lockfor PythonCVSS 6.1 · EPSS 0%CVE-2026-112940Filelock ReadWriteLock: SQLitereopens the lock database byname, so a planted symlink or…CVSS 7.1 · EPSS 0%Upgrade Tox-dev Filelock4.2.1 · 4.0.9or later on your release lineWho is exposedTox-dev Filelock before 4.2.1YELLOW · PLAN IT INTox-dev Filelockfilelock is aplatform-independent file lockfor Python. From 4.0.0 until4.2.1, SoftReadWriteLockrefreshes holder records byname, allowing another localuser with rename access to the…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-694 (CWE-694)1 other warning in 30 days →Same productEarlier filelock warnings9 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Tox-dev Filelock: Yellow, plan it in. filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable …

The flaws

  • CVE-2026-112906: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse (CVSS 4.7 · EPSS 0%)
  • CVE-2026-112934: Filelock is a platform-independent file lock for Python (CVSS 6.1 · EPSS 0%)
  • CVE-2026-112936: Filelock is a platform-independent file lock for Python (CVSS 6.1 · EPSS 0%)
  • CVE-2026-112940: Filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files (CVSS 7.1 · EPSS 0%)

The fix

Upgrade Tox-dev Filelock: 4.2.1 · 4.0.9 or later on your release line

Who is exposed: Tox-dev Filelock before 4.2.1

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 4.7 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
filelockpip>= 4.1.0, <= 4.2.04.2.1

References

Original description

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the observation, and an honest contender creates a fresh marker on the reused inode, causing that live marker to be removed as stale. This issue is fixed in version 4.2.1.

Last activity 23 Oct 2026. Patch Forecast updates every hour.