CVSS 4.7 (medium) · published 2026-10-20
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the observation, and an honest contender creates a fresh marker on the reused inode, causing that live marker to be removed as stale. This issue is fixed in version 4.2.1.
Affected products (NVD): tox-dev filelock
Fixed in (NVD): 4.2.1
Weakness: CWE-694, CWE-362
Source: NVD CVE-2026-112906
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.