{"id":"ghsa-ghsa-9c4x-gm8v-wgc4","seq":2056946,"kind":"advisory","title":"filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion","url":"https://github.com/advisories/GHSA-9c4x-gm8v-wgc4","permalink":"https://vulnpulse.app/items/ghsa-ghsa-9c4x-gm8v-wgc4","summary":"影響: pip:filelock >= 3.30.0, <= 4.2.0 → 4.2.1\nStrictSoftFileLock, AsyncStrictSoftFileLock, SoftReadWriteLock and AsyncSoftReadWriteLock keep their whole ownership state as files in a directory derived from the lock path ( .filelock/claims, .rw/{gen,holders}). When that directory already exists they adopt it after checking only that it is a real directory, not who owns it. Another local user who can create names in the lock's directory can create the tree before the first acquire on that path by the user running the lock (below: the lock us…","severity":"medium","techs":["python"],"cves":["CVE-2026-112911"],"tags":["GHSA-9c4x-gm8v-wgc4","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:08:59.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}