{"id":"ghsa-ghsa-69hj-f68j-2879","seq":2056951,"kind":"advisory","title":"filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path","url":"https://github.com/advisories/GHSA-69hj-f68j-2879","permalink":"https://vulnpulse.app/items/ghsa-ghsa-69hj-f68j-2879","summary":"影響: pip:filelock <= 4.2.0 → 4.2.1\nUnixFileLock, the backend of FileLock and AsyncFileLock on Unix, empties whatever regular file it finds at the lock path once it holds the flock (a kernel lock on an open file). With an explicit mode it also chmods that file (sets its permission bits), whether or not this acquire created it. Another local user who can rename or hard-link one of the files of the user running the lock (below: the lock user) onto the lock path gets that file truncated by the lock user's next acquire(). A hard link…","severity":"medium","techs":["python"],"cves":["CVE-2026-112909"],"tags":["GHSA-69hj-f68j-2879","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:08:35.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}