File Lock Vulnerability in Python Affects Tox Development's Filelock

CVE-2026-112908

What is CVE-2026-112908?

A vulnerability in the Filelock library, from versions 3.30.0 to 4.2.1, allows improper permission settings on coordination and claim directories for POSIX systems. This results from the StrictSoftFileLock and AsyncStrictSoftFileLock failing to apply the caller’s restrictive lock mode. As a result, if a user has a permissive umask or inherits a default ACL, these directories can become writable to other local users, potentially leading to unauthorized deletion of active claims. This could allow another process to acquire a lock while the original user is still active in their critical section, or an attacker might plant malformed claims to hinder lock acquisition. The issue has been remedied in version 4.2.1.

References