Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-112939

filelock is a platform-independent file lock for Python

Risk score
44/100
CVSS
4.7 v3.1
Exploit chance (30 days)
0.1%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove th…
Affected
Tox-dev Filelock before 4.2.1
Fix
Upgrade Tox-dev Filelock to 4.2.1 or later.
Exploitation
Public proof of concept

Story map

Story map: Tox-dev FilelockTHE FLAWSTHE FIXCVE-2026-112939Filelock is aplatform-independent file lockfor PythonCVSS 4.7 · EPSS 0%CVE-2026-112934Filelock is aplatform-independent file lockfor PythonCVSS 6.1 · EPSS 0%CVE-2026-112936Filelock is aplatform-independent file lockfor PythonCVSS 6.1 · EPSS 0%CVE-2026-112940Filelock ReadWriteLock: SQLitereopens the lock database byname, so a planted symlink or…CVSS 7.1 · EPSS 0%Upgrade Tox-dev Filelock4.2.1 · 4.0.9or later on your release lineWho is exposedTox-dev Filelock before 4.2.1YELLOW · PLAN IT INTox-dev Filelockfilelock is aplatform-independent file lockfor Python. From 4.0.0 until4.2.1, SoftReadWriteLockrefreshes holder records byname, allowing another localuser with rename access to the…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-345 (CWE-345)45 other warnings in 30 days →Same productEarlier Tox-dev Filelock warnings7 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Tox-dev Filelock: Yellow, plan it in. filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable …

The flaws

  • CVE-2026-112939: Filelock is a platform-independent file lock for Python (CVSS 4.7 · EPSS 0%)
  • CVE-2026-112934: Filelock is a platform-independent file lock for Python (CVSS 6.1 · EPSS 0%)
  • CVE-2026-112936: Filelock is a platform-independent file lock for Python (CVSS 6.1 · EPSS 0%)
  • CVE-2026-112940: Filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files (CVSS 7.1 · EPSS 0%)

The fix

Upgrade Tox-dev Filelock: 4.2.1 · 4.0.9 or later on your release line

Who is exposed: Tox-dev Filelock before 4.2.1

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 4.7 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: python

References

Original description

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.

Last activity 20 Oct 2026. Patch Forecast updates every hour.