CVE-2026-112941

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112941
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112941.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112941
Aliases
  • GHSA-wfhq-q4j2-c37m
Downstream
Published
2026-10-20T14:43:18Z
Modified
2026-10-22T02:49:06Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
Details

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the first acquisition to redirect lock-record writes into directories writable by the lock user. This issue is fixed in version 4.2.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-367"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112941.json"
}
References

Affected packages

Git / github.com/tox-dev/filelock

Affected ranges

Type
GIT
Repo
https://github.com/tox-dev/filelock
Events
Introduced
6c0ecc28f898f08cd0438cd489c3eaabad79a4b7
Fixed
60331bb89f325020b48bc51bde904c6446384e4a
Fixed
bfa066d65a1ba9106f86ee9d027f7588b9c77e03
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "4.1.0"
                },
                {
                    "fixed":  "4.2.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "bfa066d65a1ba9106f86ee9d027f7588b9c77e03"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "4.2.1",
            "range":  [
                {
                    "fixed":  "60331bb89f325020b48bc51bde904c6446384e4a"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

4.*
4.1.0
4.1.1
4.1.2
4.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112941.json"