CVE-2026-112939
Received Received - Intake

SoftFileLock Race Condition in filelock

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112939
EUVD
EUVD-2026-105029

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tox-dev filelock >= 3.22.0, < 4.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the filelock library in Python versions 3.22.0 to 4.2.0. It allows a local attacker to bypass file locks by forging the process ID (PID) in a writable marker file. The attacker tricks the lock mechanism into thinking the original holder is dead, enabling another process to acquire the lock simultaneously. This leads to concurrent access to protected resources without error.

Detection Guidance

Check filelock version with pip show filelock. If version is between 3.22.0 and 4.2.0, the system is vulnerable. Inspect marker files in lock directories for group/other write permissions or sticky bits. Look for unexpected PID values in marker files that may indicate tampering.

Impact Analysis

If exploited, this vulnerability could allow unauthorized processes to access or modify files protected by filelock. This may lead to data corruption, race conditions, or unintended behavior in applications relying on file locks for synchronization. The attack requires local access and low privileges but could disrupt critical operations in multi-process environments.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access to sensitive data, violating integrity and confidentiality requirements in GDPR and HIPAA. If exploited, it may lead to data breaches or unauthorized modifications, undermining compliance with data protection and security standards.

Mitigation Strategies

Upgrade filelock to version 4.2.1 or later. Avoid group/other write permissions on marker files or directories. Set umask to 0022 or stricter to prevent writable markers. Ensure directories containing lock files are not world-writable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112939. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart