File Lock Vulnerability in Python Library Affecting Tox Dev
CVE-2026-112915

5.5MEDIUM

Key Information:

Vendor

Tox-dev

Status
Filelock
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112915?

A vulnerability exists in the filelock Python library that allows a local user to manipulate an SQLite lock database. This can result in acquisition operations stalling or hanging, particularly in versions 3.20.4 through 4.2.1. When an instance of filelock is opened, it does not limit the schema and query workload, making it susceptible to interference. The issue is rectified in version 4.2.1, which addresses these concerns and improves stability.

Affected Version(s)

filelock >= 3.20.4, < 4.2.1

References

https://github.com/tox-dev/filelock/security/advisories/G...
x_refsource_CONFIRM
https://github.com/tox-dev/filelock/pull/834
x_refsource_MISC
https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.