What’s Vulnerable › Products

tox-dev filelock vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your tox-dev filelock version is affected

Latest tox-dev filelock vulnerabilities

• CVE-2026-112941 — filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock (CVSS 3.3)
• CVE-2026-112940 — filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files (CVSS 7.1)
• CVE-2026-112939 — filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker (CVSS 4.7)
• CVE-2026-112937 — filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name (CVSS 6.1)
• CVE-2026-112936 — filelock: ReadWriteLock follows a symlink at the lock path into SQLite (CVSS 6.1)
• CVE-2026-112935 — filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders (CVSS 4.7)
• CVE-2026-112934 — filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record (CVSS 6.1)
• CVE-2026-112915 — filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout (CVSS 5.5)
• CVE-2026-112914 — filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory (CVSS 5.3)
• CVE-2026-112912 — filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker (CVSS 2.5)
• CVE-2026-112911 — filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion (CVSS 6.3)
• CVE-2026-112909 — filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path (CVSS 6.1)
• CVE-2026-112906 — filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse (CVSS 4.7)
• CVE-2026-22701 — filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock (CVSS 5.3)
• CVE-2025-68146 — filelock has TOCTOU race condition that allows symlink attacks during lock file creation (CVSS 6.5)