CVE-2026-112939

Published: Ott 20, 2026 Last Modified: Ott 20, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 4,7
Source: [email protected]
Attack Vector: local
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none

Description

AI Translation Available

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.

345

Insufficient Verification of Data Authenticity

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Other
Potential Impacts:
Varies By Context Unexpected State
Applicable Platforms
Technologies: ICS/OT
View CWE Details
https://github.com/tox-dev/filelock/security/advisories/GHS…
https://github.com/tox-dev/filelock/security/advisories/GHSA-rfpc-qcw5-3pc4
https://github.com/tox-dev/filelock/commit/eeceaa846cbe4df7…
https://github.com/tox-dev/filelock/commit/eeceaa846cbe4df72718d94c8371ca1ab8f5…
https://github.com/tox-dev/filelock/pull/836
https://github.com/tox-dev/filelock/pull/836
https://github.com/tox-dev/filelock/releases/tag/4.2.1
https://github.com/tox-dev/filelock/releases/tag/4.2.1
https://github.com/tox-dev/filelock/security/advisories/GHS…
https://github.com/tox-dev/filelock/security/advisories/GHSA-rfpc-qcw5-3pc4