{"id":"CVE-2026-112934","summary":"filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record","details":"filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.","aliases":["GHSA-fj95-fr6c-h845"],"modified":"2026-10-22T02:47:54.675152007Z","published":"2026-10-20T14:30:43.736Z","database_specific":{"cwe_ids":["CWE-62"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112934.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112934.json"},{"type":"FIX","url":"https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03"},{"type":"FIX","url":"https://github.com/tox-dev/filelock/pull/842"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"},{"type":"ADVISORY","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-fj95-fr6c-h845"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112934"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tox-dev/filelock","events":[{"introduced":"7e574366455fdf792dbfc8cc71e5e3c11f31d130"},{"fixed":"60331bb89f325020b48bc51bde904c6446384e4a"},{"fixed":"bfa066d65a1ba9106f86ee9d027f7588b9c77e03"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"4.0.0"},{"fixed":"4.2.1"}]},{"range":[{"fixed":"bfa066d65a1ba9106f86ee9d027f7588b9c77e03"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"60331bb89f325020b48bc51bde904c6446384e4a"}],"source":"REFERENCES_TAG","original_tag":"4.2.1"}]}}],"versions":["4.2.0","4.1.2","4.1.1","4.1.0","4.0.12","4.0.11","4.0.10","4.0.9","4.0.8","4.0.7","4.0.6","4.0.5","4.0.4","4.0.3","4.0.2","4.0.1","4.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112934.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"}]}