{"id":"ghsa-ghsa-2g95-wg33-c5x2","seq":661299,"kind":"advisory","title":"filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse","url":"https://github.com/advisories/GHSA-2g95-wg33-c5x2","permalink":"https://vulnpulse.app/items/ghsa-ghsa-2g95-wg33-c5x2","summary":"影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1\nSoftFileLock and MarkerSoftFileLock evict an unparsable marker (the lock file at , whose presence says a process holds the lock) once a waiting contender has watched it unchanged for two seconds. SoftFileLease expires a lease the same way. The watch tells two looks apart by the marker's modification time (mtime) and inode number (the kernel's identity for a file, independent of its name) alone. Another local user (the other user below) who can create files in the lock's directory, a sticky /tmp…","severity":"medium","techs":["python"],"cves":["CVE-2026-112906"],"tags":["GHSA-2g95-wg33-c5x2","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:00:33.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}