Race Condition in File Locking for Python Products by Tox Dev

CVE-2025-68146

What is CVE-2025-68146?

The filelock library for Python, which allows for platform-independent file locking, is vulnerable to a Time-of-Check-Time-of-Use (TOCTOU) race condition in versions prior to 3.20.1. This vulnerability can enable local attackers to manipulate file handling procedures, potentially leading to corruption or truncation of arbitrary user files via symlink attacks. The flaw occurs during the creation of lock files across various systems, including Unix, Linux, macOS, and Windows. Attackers can exploit the gap between the existence check and the opening of the file, resulting in unauthorized file manipulation. Mitigations include upgrading to version 3.20.1, utilizing alternative locking mechanisms, and implementing stringent permission settings for lock file directories. However, these workarounds are only partially effective, and the exploitability of the race condition remains a concern.

References