{"id":"ghsa-ghsa-6627-m3xw-93mp","seq":2056945,"kind":"advisory","title":"filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold","url":"https://github.com/advisories/GHSA-6627-m3xw-93mp","permalink":"https://vulnpulse.app/items/ghsa-ghsa-6627-m3xw-93mp","summary":"影響: pip:filelock >= 3.30.0, <= 4.2.0 → 4.2.1\nStrictSoftFileLock and AsyncStrictSoftFileLock apply the caller's mode to the sentinel (the lock file at ) and to both claim files (the files whose presence says a process wants or holds the lock). They create the two directories that hold the claims, .filelock and .filelock/claims, with a bare mkdir(). That gives 0o777 filtered through the umask (a per-process mask that removes permission bits from new files and directories) or, under a parent with a default ACL (an access control list on a di…","severity":"medium","techs":["python"],"cves":["CVE-2026-112908"],"tags":["GHSA-6627-m3xw-93mp","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:09:04.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}