CVE-2026-112939 in filelock
Summary
by MITRE • 10/20/2026
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.