Symbolic Link Vulnerability in File Lock for Python by Tox

CVE-2026-112936

What is CVE-2026-112936?

The filelock library, which provides a platform-independent file locking mechanism for Python, has a vulnerability present in versions 3.20.4 through 4.0.8. Specifically, the ReadWriteLock and AsyncReadWriteLock components resolve the lock path and pass it to SQLite without adequately rejecting the final symbolic link. This creates a potential exploit where a malicious local user can manipulate the database creation and locking process by creating names in the lock directory, effectively disrupting mutual exclusion between targets. Users are encouraged to upgrade to version 4.0.9, where this issue has been addressed.

References