{"id":"ghsa-ghsa-rfpc-qcw5-3pc4","seq":2056949,"kind":"advisory","title":"filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker","url":"https://github.com/advisories/GHSA-rfpc-qcw5-3pc4","permalink":"https://vulnpulse.app/items/ghsa-ghsa-rfpc-qcw5-3pc4","summary":"影響: pip:filelock >= 3.22.0, <= 4.2.0 → 4.2.1\nSoftFileLock, MarkerSoftFileLock, SoftFileLease, their async variants and a FileLock that has fallen back to a soft lock on ENOSYS decide from the record inside the marker file whether its owner is gone. The marker is the file whose presence says a process holds the lock. They do not check who could have written that record. A local user who can write the marker but cannot remove it rewrites the holder's record to name a dead PID (process id). That position arises with an explicit mode with gro…","severity":"medium","techs":["python"],"cves":["CVE-2026-112939"],"tags":["GHSA-rfpc-qcw5-3pc4","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:08:45.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}