CVE-2026-112934
Received Received - Intake

SoftLink Replacement in filelock Library

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112934
EUVD
EUVD-2026-105023

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tox-dev filelock >= 4.0.0, < 4.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-62 The product, when opening a file or directory, does not sufficiently account for when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the filelock Python library versions 4.0.0 to 4.2.0. It involves a race condition in SoftReadWriteLock where a local attacker can manipulate lock records by replacing them with hard links or named pipes. This causes the lock holder to hang, overwrite files, or lose the lock without notice.

Detection Guidance

Check the installed version of the filelock library using pip show filelock. If the version is between 4.0.0 and 4.2.0, the system is vulnerable. Inspect lock directories for unexpected hard links or named pipes in /tmp or other shared directories. Monitor for processes hanging indefinitely during file operations.

Impact Analysis

An attacker could stall your lock indefinitely, overwrite parts of your files, or cause denial of service. This requires the attacker to control the lock directory or have write access to a shared directory. The impact is limited to local users with low privileges.

Mitigation Strategies

Upgrade the filelock library to version 4.2.1 or later using pip install --upgrade filelock. Ensure the lock directory is owned by the user and not writable by others. Disable hard link creation in shared directories by setting fs.protected_hardlinks=1 in Linux.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112934. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart