{"id":"ghsa-ghsa-crv4-6mhj-j5jh","seq":661300,"kind":"advisory","title":"filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory","url":"https://github.com/advisories/GHSA-crv4-6mhj-j5jh","permalink":"https://vulnpulse.app/items/ghsa-ghsa-crv4-6mhj-j5jh","summary":"影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1\nWhen a soft-lock stale break finds that the marker (the lock file at ) it renamed aside was a live one recreated by a successor, the restore branch of break_lock_file() checks the break name with lstat (a check that reads a name without following a symbolic link) and then calls os.link(break_path, lock_file) by name. On CPython 3.12 and later on Linux (and on macOS) that call follows a symbolic link (a file that redirects to another path). A local user (the other user below) who can write a sha…","severity":"medium","techs":["python"],"cves":["CVE-2026-112914"],"tags":["GHSA-crv4-6mhj-j5jh","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:00:11.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}