{"id":"ghsa-ghsa-wfhq-q4j2-c37m","seq":2056944,"kind":"advisory","title":"filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock","url":"https://github.com/advisories/GHSA-wfhq-q4j2-c37m","permalink":"https://vulnpulse.app/items/ghsa-ghsa-wfhq-q4j2-c37m","summary":"影響: pip:filelock >= 4.1.0, <= 4.2.0 → 4.2.1\nSoftReadWriteLock (and AsyncSoftReadWriteLock, which wraps one) checks once per lock object, by name, that .rw, .rw/gen and .rw/holders are real directories and not symbolic links (files that redirect to another path). It then keeps only a boolean. Every later record operation resolves the full path again, and O_NOFOLLOW (a flag that makes an open fail when the final name is a symbolic link) protects the last component only. Another local user (the other user below) who can write the directory…","severity":"low","techs":["python"],"cves":["CVE-2026-112941"],"tags":["GHSA-wfhq-q4j2-c37m","filelock"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:09:09.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}