{"id":"ghsa-ghsa-fj95-fr6c-h845","seq":2056954,"kind":"advisory","title":"filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record","url":"https://github.com/advisories/GHSA-fj95-fr6c-h845","permalink":"https://vulnpulse.app/items/ghsa-ghsa-fj95-fr6c-h845","summary":"影響: pip:filelock >= 4.0.0, <= 4.2.0 → 4.2.1\nSoftReadWriteLock (and AsyncSoftReadWriteLock, which wraps one) refreshes its holder record (the file under .rw/holders/ that says a process holds or wants the lock) on every poll of a waiting acquire and on every heartbeat (the periodic refresh a holder runs to keep its record fresh). It does so by reopening .rw/holders/ by name with a plain blocking O_WRONLY | O_NOFOLLOW open and writing at offset 0, without checking what it opened. O_NOFOLLOW makes the open fail only when the final name is a…","severity":"medium","techs":["python"],"cves":["CVE-2026-112934"],"tags":["GHSA-fj95-fr6c-h845","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:08:13.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}